03.08.01 Media storage: requirements and evidence

What NIST SP 800-171 03.08.01 media storage asks for

If a contract requires NIST SP 800-171, your controlled unclassified information (CUI) does not stay in one system. It sits on USB flash drives in someone's bag, backup tapes in a closet, copies on a shared drive, and printed pages in a desk drawer. Requirement 03.08.01 (Media storage) asks you to physically control and securely store every piece of system media that holds CUI, whatever its form. The first job is finding those copies, because you cannot protect media you do not know exists.

NIST defines system media in two groups. Digital media includes flash drives, magnetic tapes, external hard drives and optical discs. Non-digital media includes paper and microfilm. Secure storage means something like a locked drawer, a locked cabinet or a controlled media library with restricted entry. Requirement 03.08.01 comes from the SP 800-53 Rev. 5 control MP-4 (Media storage). In Rev. 2 the same obligation was numbered 3.8.1, and NIST's change analysis classifies the Rev. 3 wording as editorial only, so an assessor will expect the same storage evidence under either version. Confirm the exact wording and assessment objects in the NIST SP 800-171 Rev. 3 publication before you write procedures.

The difficulty is usually scope, not the lock. Media spreads across desks, laptops, backup sets, offices and remote homes, and each copy is easy to forget. Start by building an inventory of where CUI is stored on removable and physical media, then assign each location an owner and a storage method. Inventory tools such as GLPI's Assets module can record computers, peripherals and other equipment, but they will not track a paper file or a tape in a box, so those need a manual register. Ask your assessor which evidence they expect for physical media, and confirm how your system security plan describes storage locations.

Which media, systems and people fall under 03.08.01

Scoping under 03.08.01 starts with one question: where does CUI sit on media, and who can reach it. The decisions below set the boundary of the storage work, and the ones on paper, backup locations and provider-held media usually change the effort most.

Digital media versus non-digital media

NIST's Rev. 3 discussion treats flash drives, magnetic tapes, external drives and optical discs as digital system media, and paper and microfilm as non-digital system media. Both types fall under 03.08.01 when they hold CUI. Build one inventory that lists each media type, its CUI content and its storage location, because paper printouts are often the forgotten category. Ask whether printed CUI in offices is covered before you size the locked storage work.

Media inside the CUI enclave

Media that sits inside the defined CUI boundary, such as external drives in a secure engineering room or tapes in a controlled data center, is the core of the assessment. Assessors will look for a documented storage method, access limited to authorized roles, and a clear record of where each item sits. Confirm the boundary in the system security plan so that every media store inside it has an owner and a storage rule.

Media in offices and labs

Desks, shared printers, lab benches and personal drawers are where CUI often escapes the enclave. An illustrative case: a project team saves a CUI design file to a USB drive kept in an unlocked desk. Such media still falls under 03.08.01 if it holds CUI, even outside the main environment. Check for media used outside the enclave, and decide whether to move it into a locked cabinet, restrict it, or prohibit it.

Backup tapes and off-site copies

Backup tapes or disks stored in another facility, a vaulting provider's location or a colocation cage extend the storage scope. Each location needs the same physical control and secure storage as primary media. Ask where every backup copy physically resides, who can retrieve it, and whether the storage location is in the system security plan. Off-site copies are a common gap because teams track primary systems but not the vault.

Media held by cloud and hosting providers

When CUI sits in a cloud or hosting environment, the provider operates the physical media, but the organization still needs to show that storage is controlled. Confirm which storage responsibilities the provider takes on, which fall to your team, and what the provider's documentation covers. Get written evidence of the provider's physical media controls and check that they match the requirements your contract imposes. Do not assume shared responsibility covers this without reading it.

Third-party service providers and personnel

Repair vendors, document shredding firms, recovery specialists and offsite storage companies may handle CUI-bearing media. Their access and handling need contract terms and records. Personnel with media storage duties must be named, trained and listed in the assessment evidence, since 03.08.01 assessors interview them directly. Confirm who holds the keys to storage areas and who signs for media movements.

How an assessor tests 03.08.01 media storage

This table sets out the three assessment methods SP 800-171A Rev. 3 uses for 03.08.01, the objects each one covers, the evidence an assessor will ask for and the findings that come up most often. Read each row as a question the assessor will put to your team, and gather the matching evidence before the assessment starts.

Method	What the assessor reviews	Evidence requested	Common findings
Determination statements	Two statements: the organization physically controls system media containing CUI, and it securely stores that media. Each is judged against the methods below.	A written statement of how each media type is controlled and stored, mapped to the system security plan entry for 03.08.01.	Plan entry that repeats the requirement without naming locations, media types or responsible roles.
Examine	Physical protection policy and procedures, media protection policy and procedures, procedures for media storage, access control policy and procedures, and the system media themselves.	Approved policies and procedures with review dates, a media inventory, storage location records and access control rules for storage areas.	Procedures that exist only in draft, or media inventories that omit flash drives, tapes, external drives and paper records.
Interview	Personnel with system media protection and storage responsibilities, and personnel with information security responsibilities.	Staff able to name where CUI media is kept, who holds keys or badges to storage, and what they do when media is lost or left unattended.	Staff who describe storage from memory, disagree on locations, or cannot say who approves access to a media library.
Test	Processes for storing information media and the mechanisms that support secure storage, such as locked cabinets, controlled media libraries, badge logs and storage room controls.	Observed storage in a walkthrough, lock and key or badge records, and samples showing media returned to its storage location after use.	Locked cabinets with keys left in the lock, or media libraries that anyone with building access can enter unlogged.
Unlabelled and untracked media	Whether removable and non-digital media holding CUI can be traced to a storage location and an owner.	Asset records for portable media, labels or tags linking each item to its location, and a check-out or check-in log.	Unlabelled flash drives and paper printouts stored in desk drawers with no record of their location.
Undocumented storage locations	Whether every place that holds CUI media is named in the plan, the inventory and the storage procedures.	A list of storage locations, including offices, server rooms, vehicles used for transport and off-site vaults, tied to the system boundary.	Storage at a branch office, home office or contractor site that appears in no procedure.
CMMC Level 2 equivalence	CMMC Level 2 assesses the requirement as MP.L2-3.8.1, worth 3 points under 32 CFR 170.24. Under 32 CFR 170.21, it cannot be placed on a POA&M for Conditional status.	Evidence must be complete at assessment time for this practice, so confirm current scoring and POA&M rules in the eCFR text before planning remediation.	Teams plan to close storage gaps after the assessment, which the POA&M rules do not allow for this practice.

How to implement 03.08.01 in the order that passes review

This sequence moves from knowing where CUI-bearing media sits to proving that storage works as written. Each step produces a record an assessor can examine, interview staff about, or test.

Inventory every media type that holds CUI
List each form of system media that holds or may hold CUI, covering digital media such as flash drives, external drives, magnetic tapes and optical discs, and non-digital media such as paper and microfilm. For each item, record the location, the custodian, the system or process that produces it and the data it contains. Asset records from a tool such as GLPI can hold hardware entries, and Wazuh Syscollector can show endpoint hardware and storage details, but paper and removable media usually need manual entries. The step closes with a media inventory signed off by the system owner, reviewed against the system security plan boundary.
Define a storage method for each media type
For each inventoried type, write the storage standard that applies. Paper and microfilm typically go in a locked drawer or cabinet with restricted keys. Tapes, drives and other removable digital media typically go in a controlled media library with a check-in and check-out record. Digital media that hold CUI at rest should also be encrypted and access-restricted, and the encryption approach should be confirmed against the separate requirements in 03.13. The output is a storage standard that names the container or room, the access rule and the protection for each media type, so that a reviewer can compare what is written against what is physically present.
Assign owners and write the storage procedures
Name an owner for each storage location and an accountable owner for the media protection program as a whole. Write the procedures for storing, retrieving and logging media, and link them to the physical protection and media protection policies that already exist. Confirm that the procedures cover who may request media, how keys or access cards are issued and recovered, and what happens when media is found outside its storage location. The assessment method examines the policy and procedures, so the output is a signed, dated procedure with a named owner and a review date, stored where the people who use it can find it.
Set up physical and logical controls with access logs
Install the locks, cabinets, media library cages or encryption and permission settings defined in the storage standard. Configure logical access to digital media so that only authorized roles can read or mount it, and turn on logging for those actions where the platform supports it. Keep a sign-out and access log for controlled media libraries and locked storage, including the person, date, item and purpose. Test the physical controls by checking that the containers lock and that keys or access credentials are assigned to named individuals. The output is a configured storage environment and a log that shows the controls are in use.
Train the people who handle media
Brief everyone who stores, retrieves or moves CUI media on the storage standard, the procedures and the logging rules. Cover what each media type is, where it must be kept, who may access it and how to report a missing or misplaced item. Training should be delivered before people receive access to storage locations and repeated when procedures change. Keep attendance records and the training material, because an assessor will interview personnel with media storage responsibilities and ask how they know the rules. The output is a training record for each person with a storage role.
Run a first internal check against the assessment methods
Before an external assessment, test the storage program against the three SP 800-171A assessment methods: examine the documents, interview the responsible personnel, and test the mechanisms. Walk the media inventory against the actual storage locations, ask custodians to explain the procedure without reading it aloud, and attempt to retrieve a sample item through the documented process. Record any gap, such as an unlisted item, a missing log entry or a key held by someone not on the access list. The output is a dated internal test record with findings, owners and corrective actions, which the organization can use to correct the program before the assessor arrives. Any independent review of this work is performed by a qualified assessor, not by the implementation partner.

Evidence that passes a 03.08.01 review

A 03.08.01 review tests whether CUI-bearing media are physically controlled and stored securely, and whether people can show it. The six artifacts below connect policy, inventory, physical controls and staff practice, so an assessor can trace one flash drive or one box of paper from the rule to the record.

Media protection policy and procedures

The written policy states which media types hold CUI and who is responsible for storing them. The procedures explain the steps staff follow for storage, access and handover. Review the document on a fixed schedule, record the owner's sign-off, and update it when media types, storage rooms or responsibilities change. A reviewer will sample the current version, check the approval date, and compare the steps against what staff describe in interviews. Confirm the policy and procedures reference the System Security Plan so the two stay consistent.

Storage standard with approved locations

This standard lists the approved containers and locations for each media type, such as a locked drawer, a locked cabinet or a controlled media library, and states what is not allowed. It should name the container specifications and the key or combination custodian. Revisit the list when the facilities team moves, retires or adds a storage room, and when a new media type enters use. A reviewer will compare the listed locations with the actual rooms and cabinets they walk through and ask who holds the keys.

Media inventory with owners and locations

The inventory records each digital and non-digital item that holds CUI, its owner, its classification and its current storage location. An asset module or inventory agent can populate the hardware list, but the storage location and owner fields usually need manual upkeep. Reconcile the inventory on a set cadence and after any move, loss or disposal. A reviewer will pick several items at random, locate them in the stated place, and confirm the owner matches the record. Mismatches are the fastest route to a finding.

Physical access lists and access logs

Access lists name the people authorized to enter storage rooms and open cabinets, and access logs record who entered and when. Review the list at a defined interval and remove people who change roles or leave. Badge or sign-in logs should be retained and reviewed, not just collected. A reviewer will compare a recent log against the access list and look for entries from people who are not authorized, or for gaps where a room was open without a record. Confirm with your facilities team how long logs are kept.

Custody and check-out records for removable media

Check-out records show who took a flash drive, external disk or tape out of storage, when, for what purpose and when it came back. They are the working proof that storage is controlled in day-to-day practice. Keep a single log per media item or per library, sign each entry, and close every open check-out within a set period. Changes to the process, such as moving to a digital sign-out tool, should be dated and approved. A reviewer will look for items that have been out for an unusual time and ask how the owner was contacted.

Training records for media handlers

Training records show that staff who store, retrieve or move CUI media know the storage rules and the consequences of skipping them. Record the course content, the date, the attendee and the role. Refresh the training when the policy changes and when a person's duties change, and retain completion records for staff who no longer handle media. A reviewer will select a sample of people from the access list and ask to see their completion records, then ask them to describe the storage steps in their own words.

What meeting 03.08.01 costs in money and effort

This table lists each cost component of storing CUI media securely, who is usually paid for it, whether it is one-time or recurring, and what pushes it up or down. No supplied source gives a dollar figure or duration, so use the quote items in the final column of your request to compare partner and internal estimates.

Cost component	One-time or recurring	What drives it up	How to keep it down
Locks, cabinets and media library fittings	One-time purchase, with occasional replacement	Number of media types, number of sites, and volume of paper records that need locked storage	Consolidate media into a small number of controlled storage points and standardize on one cabinet class
Encrypted removable media or storage	One-time for devices, recurring for licenses and key management	Number of removable devices in use and the number of users allowed to hold CUI on them	Retire removable media where possible and keep CUI on managed systems with encryption already in place
Engineering or facilities time to write and enforce the storage standard	One-time to write, recurring to review and enforce	Number of sites, number of media types covered by the standard, and exceptions that need separate handling	Write one storage standard that covers digital and non-digital media together and reuse it across sites
Inventory and custody record upkeep	Recurring	Number of media items, frequency of movement between storage points, and whether records are kept by hand or in a tool	Use an asset inventory tool with automated discovery for systems, and a single custody log for portable media
Staff training on storage rules	One-time for initial training, recurring for refreshers and new hires	Number of personnel who handle CUI media and turnover in those roles	Fold storage rules into the broader CUI training so staff take one course and refresh on a set cycle
External review of storage procedures	Recurring when reviewed before an assessment or after major changes	Breadth of the procedures, number of sites reviewed, and whether the review covers technical as well as physical controls	Ask the partner to review once against the requirement and its assessment objectives, then limit later reviews to changed areas
Auditor or assessor sampling	Recurring at each assessment, paid to the assessor, not to a partner	Number of storage locations sampled, number of media records requested, and gaps found in the first sample	Keep one current inventory and custody record so samples can be pulled quickly and without rework

How self-hosted open-source tools support the 03.08.01 evidence

Assessors testing 03.08.01 Media storage want to see which system media exist, where they are kept and who controls them. Open-source inventory and endpoint tools can supply part of that picture, but they record assets and system data rather than physical storage conditions, so they work best alongside the paper and custody records an organization keeps itself.

GLPI asset inventory

GLPI (GPL-3.0-or-later) manages computers, monitors, software, network equipment, peripherals, printers, phones and racks in its Assets module. Records can be entered manually or pushed automatically by the GLPI Agent through native inventory built into GLPI since version 10. If the organization records removable media and their storage locations as assets, GLPI can hold a media and storage-location inventory that an assessor can review. Confirm that the asset types and fields you need exist in your installed version, and decide who updates locations when media move.

Wazuh endpoint inventory

The Wazuh Syscollector module (GPL-2.0-only) collects hardware, operating system, installed software, network interfaces, open ports, running processes, services, users and groups from each endpoint. It stores this data in the Wazuh indexer, where the dashboard shows inventory views and reports. This helps show which endpoints exist and what they run, which supports 03.08.01 by identifying devices that could hold CUI. It does not prove that removable media are locked away, so confirm with your team what Syscollector cannot see, such as unattached drives.

Who owns, implements and assesses 03.08.01

Your organization owns requirement 03.08.01. That ownership does not move to a vendor or consultant, even when outside help builds the evidence. Your team decides which locations and media count as CUI storage, writes the storage standard, runs the physical facilities where media sit, and approves any exception to the standard. The assessor will ask named people, not a service provider, to explain how storage works day to day.

Owner of the control: Name an accountable person for media storage and record that role in the system security plan.
Storage standard: Write the rules for locked drawers, cabinets, media libraries and room access, and state who may open them.
Facilities operations: Keep the locks, keys or badge access lists working and current, and record who holds them.
Exception approval: Decide, in writing, when a deviation from the standard is acceptable, how long it lasts and how it is tracked, including any plan of action and milestones entry.
Staff training: Make sure the people who hold CUI media know the storage rules and can show they were trained.

Before you engage anyone, confirm that your own staff can answer the interview questions for 03.08.01 without reading from a vendor document.

Where 03.08.01 fails and how to close each gap

Most media storage findings come from the same root problem: the organization cannot show where CUI-bearing media sits, who can reach it, and whether the written procedure matches what people actually do. The cards below cover the gaps assessors most often trip over, with the check that exposes each one and the step that closes it.

Removable media with no inventory

Flash drives, external disks and optical discs are often held in desk drawers or team boxes and never recorded. An assessor will pick a sample of people who handle CUI and ask where their removable media is, then compare the answer against any list the organization keeps. Build a register of every removable device that may hold CUI, record its holder and storage location, and reconcile it against endpoint inventory. Wazuh Syscollector and GLPI can show attached hardware and asset records, which helps you find devices the register missed.

Paper CUI in unlocked spaces

Printed drafts, marked-up copies and microfilm are system media too, and they are frequently left on desks, in open bins or in unlocked offices overnight. An assessor walks the floor after hours and looks for CUI in plain view or in cabinets without locks. Assign a locked drawer, cabinet or controlled media library for each category of paper CUI, set a clear-desk expectation for end of day, and check it with periodic walkthroughs that you document.

Backup tapes with no access record

Tapes and backup disks often sit in a rack or vault that only the backup administrator uses, with no sign-out log and no record of who opened the cabinet. Assessors ask for a log of who accessed the storage location and for evidence that the log is reviewed. Keep a dated access record for every backup media location, restrict the keys or badges to named roles, and confirm that restores and rotations appear in the record. Encryption of backup media is a separate topic, so verify storage access here only.

Procedures that describe another method

A media protection procedure may say CUI is kept in a locked media library while staff actually store it in a shared folder or a general supply cabinet. Assessors compare the written procedure with what they observe and with what interviewees describe, and a mismatch is a finding even when the storage itself is secure. Walk each procedure step with the people who perform it, correct either the document or the practice, and record the revision date and approver.

Storage rooms without access lists

Media rooms and library closets are often open to every employee, cleaners and contractors, with no list of who is authorized. An assessor asks for the current access list for each room that holds CUI media and checks it against badge or key records. Publish a named access list for each media storage area, review it on a set schedule, and remove people who change roles or leave. This list should match the physical access control and facility access records used in the physical protection family.

No owner for disposal or transfers

Media moves between storage points, goes to a vendor for repair, or is handed to a new owner for disposal, and no one is accountable for each handoff. An assessor asks who approves a move out of a storage location and who signs for it on arrival. Name one accountable owner for media movement between storage points, require a written handoff record that shows the sender, receiver and date, and route disposal requests through the same owner so sanitization steps are not skipped.

Questions buyers ask about 03.08.01 media storage

How much effort does 03.08.01 take compared with other media controls?

03.08.01 is usually one of the lighter media requirements because it asks you to physically control and securely store media that contain CUI, and SP 800-171A Rev. 3 breaks it into just two determination statements. The effort rises or falls with the number of places CUI sits on media: a single locked cabinet for paper is simple, while flash drives, tapes, laptops and backup sets spread across several sites take more inventory and more storage rules. The heavier work usually falls in sibling controls such as 03.08.03 media sanitization and 03.08.05 media transport, which add disposal, marking and custody steps. Ask any partner to size the effort from your media inventory, not from the control count alone.

How long does it take to put media storage controls and evidence in place?

No fixed duration applies to this control because it depends on how many storage locations you have, how well your media are already inventoried, and whether your storage rules are written down. The organization needs to name who owns media storage, define the approved storage locations and containers, write the media protection procedure, and collect records such as access lists and storage logs. Those tasks need time from security, facilities and the staff who handle media day to day. Ask a prospective partner for a timeline tied to a written scope and a list of the storage locations it will cover.

Can an in-house team implement 03.08.01 without outside help?

Yes, an in-house team can implement 03.08.01 if it has someone who owns media protection, access to facilities staff, and the time to write procedures and gather evidence. The control is mostly policy, physical arrangements and records, so the skills are closer to records management and facilities control than to deep engineering. Outside help is most useful when the team needs an independent check of its scope, support for inventory tools, or a partner to prepare evidence for an assessment. Whatever you choose, the organization keeps ownership of the control and of any decision to accept risk.

Is 03.08.01 still 3.8.1 in CMMC, and why does the numbering matter for POA&M use?

Yes. NIST's change analysis traces 03.08.01 to Rev. 2 requirement 3.8.1 and classifies the change as editorial, while CMMC Level 2 still uses Rev. 2 and assesses 3.8.1 as MP.L2-3.8.1, worth 3 points under the 32 CFR 170.24 scoring methodology. The numbering matters because 32 CFR 170.21 does not allow this requirement on a plan of action and milestones for Conditional status, so a gap here cannot simply be deferred. Confirm the current CMMC and DFARS status with your contracting officer, since the rules for Rev. 2 and Rev. 3 are changing.

Do paper records count as system media under 03.08.01, and how do I store them?

Yes, NIST's discussion of system media includes non-digital media such as paper and microfilm, so printed CUI falls under 03.08.01. Secure storage for paper means a locked drawer, a locked cabinet or a controlled media library, with access limited to people who need the information. Keep an inventory of where paper CUI is held, restrict who holds keys or combinations, and record checkouts where your procedure requires them. Printed CUI also needs the protections in the sibling controls for marking and sanitization before it is destroyed.

What can a partner sign off on for 03.08.01, and what can it not?

A partner such as DeployOpen can plan, implement and document the storage controls, prepare procedures, configure supporting tools, and assemble evidence for your assessment. The partner cannot decide that your storage meets the requirement, issue an assessment report, or certify compliance. Those decisions belong to you as the organization that owns the control, to the federal agency that holds the contract, and to independent assessors where an assessment applies. Ask for the written scope to name each deliverable and state that the organization keeps ownership of the controls.

What should I confirm in a quote for 03.08.01 implementation?

Confirm the exact storage locations, media types and sites covered, the people or roles responsible for each part, and the deliverables such as procedures, records templates and evidence packages. Ask which work is one-time, such as writing procedures and setting up inventory, and which recurs, such as access reviews, log checks and retainer support. Check whether the quote excludes the physical work of building cabinets or media rooms, which facilities may need to fund. Also confirm how changes in scope are priced and approved before work starts.

Which open-source tools help show what media exists before I store it?

Asset and inventory tools help you know where CUI-bearing devices are before you can secure their storage. GLPI's Assets module manages computers, peripherals and other hardware, entered manually or pushed by the GLPI Agent through native inventory built into GLPI since version 10. Wazuh's Syscollector module collects hardware, operating system and installed software details from endpoints for inventory views and reports. Neither tool tracks paper or locked storage containers, so physical records and removable media logs still need a manual process. Confirm each tool's coverage for your device types before relying on it as evidence.

How DeployOpen prepares 03.08.01 storage controls and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so storage controls for 03.08.01 Media storage are set up where the CUI actually sits. The organization owns its controls, DeployOpen prepares the systems and evidence, and an independent assessor reaches the conclusions.

How we scope

Engagements are fixed-scope, with the systems, media locations and deliverables agreed in writing before work starts.
The written scope lists every digital and non-digital media holding location that falls within the CUI boundary for 03.08.01.
Scope also names the storage policy, procedures and personnel roles that the organization must confirm before handover.

How we build

Storage controls are configured inside the client's cloud accounts, data centers or air-gapped networks, not on DeployOpen's own infrastructure.
Inventory of system media is set up with GLPI Assets and Wazuh Syscollector so hardware and endpoints are tracked from the start.
Secure storage arrangements, such as locked cabinets and controlled media libraries, are documented against the storage procedure the client adopts.

How we hand over

Handover includes configuration records, inventory exports and a written map of where each category of CUI media is stored.
Evidence is organized against the two determination statements in SP 800-171A Rev. 3 so an assessor can trace each one.
The client receives documentation it can maintain itself, and DeployOpen does not issue audit reports or certifications.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover, with the scope agreed in writing.
Retainer work can cover re-checking inventory records and storage locations as media is added, moved or retired.
Confirm with DeployOpen during quoting which evidence refresh intervals and response commitments the retainer includes.