03.08.02 Media access: requirements and evidence

NIST SP 800-171 03.08.02 media access: what the requirement asks for

If a contract or assessor now expects proof that CUI on drives, tapes, paper and backups is limited to named people or roles, the work starts with this requirement. 03.08.02 Media access asks the organization to restrict access to CUI on system media, both digital and non-digital, to authorized personnel or roles. The risk it addresses is simple: anyone who can pick up a USB stick, pull a backup set off a shelf or open a filing cabinet can read or copy CUI without touching the system that is supposed to protect it. NIST lists MP-2 from SP 800-53 Rev. 5 as the source control, so an assessor will expect the access restriction to be a deliberate, documented decision rather than something that happens to be true.

The requirement is harder than its one-line wording suggests. Media multiplies across laptops, external drives, print output, exported spreadsheets, email attachments and cloud sync folders, and many of those copies are created by people who never think of them as media. Shared accounts and shared storage locations make it unclear who is authorized, and backups quietly copy CUI to places that the original access list never covered. Rev. 3 gives the requirement one determination statement, and NIST's change analysis treats the change from Rev. 2 requirement 3.8.2 as editorial only. That does not reduce the work. CMMC Level 2 still assesses 3.8.2 as MP.L2-3.8.2, scores it at 3 points, and does not allow it on a POA&M for Conditional status, so DoD contractors should plan to meet it in full. Confirm with your contracting officer which version your contract cites before you build evidence around it.

Which media, people and third parties fall under 03.08.02

Before an organization can restrict media access, it has to decide what counts as system media holding CUI, where that media lives, who needs it and which outside providers touch it. Each decision widens or narrows the population that 03.08.02 Media access reaches, so the scope drives the effort more than any single technical control. Confirm these choices with the contracting agency before work starts.

Digital and non-digital media types

Start with an inventory of every medium that can hold CUI: USB drives, external disks, tapes, backup sets, laptops, phones, and printed or handwritten pages. Digital media fall under the access restriction when they store CUI, and non-digital media such as printed CUI fall under it too. Each medium type needs its own access rule and its own record. Ask the agency whether CUI in printouts and notes counts as in scope for the system boundary.

Systems and storage locations holding CUI

Map every system, share, repository and backup location where CUI is stored, copied or cached. Shadow copies on endpoints, exports to spreadsheets and temporary staging folders are common gaps. A location left off the inventory is a location without an access restriction. Confirm with the agency whether copies created by users count as part of the CUI system.

Roles that need access and who approves it

Define which roles may reach CUI on each medium, and name the owner who approves each grant and each removal. Access reviews help here: midPoint access certification campaigns have designated reviewers decide within a set timeframe whether to keep, change or revoke access items such as role assignments. Confirm with the agency which approval records it expects to see.

Cloud providers and managed backup services

A cloud storage service or managed backup provider that holds CUI extends the media population into the provider's environment. The organization still needs to know who can access the media, how that access is restricted, and what the contract says about it. Ask the provider for its evidence and confirm with the agency how external storage is treated under the system security plan.

Encrypted backups and key custody

Backups that are encrypted still belong in scope, because access to the media and access to the keys are separate questions. Encryption at rest in Nextcloud protects file contents with keys kept on the server, but it does not hide file names or folder structure. OpenBao's transit engine handles keys and encrypt and decrypt operations separately from stored data. Confirm with the agency where encryption keys are held and who may use them.

How an assessor tests 03.08.02 under SP 800-171A

This table breaks down how an assessor applies the single determination statement for 03.08.02 using the examine, interview and test methods in SP 800-171A Rev. 3. Read each row as one method, what the assessor looks at, what to have ready, and where assessments commonly stall. The main takeaway is that a written media access policy alone does not satisfy the requirement; the assessor will expect the configured restrictions to match what the documents say.

Method	Objects the assessor looks at	Evidence to have ready	Common findings
Examine	Media protection policy and procedures, physical protection policy and procedures, access control policy and procedures, and procedures for media access restrictions	Approved policies with owners and review dates, a written procedure that names who may access CUI on media and how access is granted and removed	Policy names roles that do not match the actual access groups, or procedures were never approved or updated after a system change
Interview	Personnel with system media protection responsibilities and personnel with information security responsibilities	Staff who can explain who holds media access, how requests are approved, and what happens when someone changes role or leaves	Staff describe a process different from the written one, or no one owns the media access decision
Test	Processes for restricting information on media and the mechanisms that support or implement media access restrictions	Sample configurations or screenshots of access controls on media and storage, such as encryption keys limited to authorized roles, and records of a sample of access grants	Policy requires restricted access but the storage or backup system grants broad access, or access rights were never reviewed after staff changes
Scope of evidence	The CUI media in scope for the assessment, including digital and non-digital media	A current inventory or description of where CUI resides on media and which roles can reach it	Assessed media inventory does not match the systems the organization actually uses
Link to related requirement	The discussion of 03.08.02 refers to 03.13.08 on transmission and storage confidentiality	Evidence that CUI on media is protected by encryption where the system uses it, with key access limited to authorized roles	Access restriction is documented, but encryption or key management for stored CUI is not described or tested

The order of work to restrict media access to authorized roles

This sequence takes 03.08.02 from an unknown media footprint to a documented, enforced and periodically reviewed set of access restrictions. Each step produces an artifact that an assessor can examine, interview against and test.

Inventory where CUI sits on media and backups
Identify every system media type and location that holds CUI, including laptops, workstations, removable drives, tapes, optical media, paper, cloud storage buckets and backup repositories. Your IT and security staff lead this work, with input from the data owners who know which records are CUI. The output is a media inventory that maps each item or store to its CUI category, its owner and its custodian. The step is done when someone can answer, for any CUI record, where every copy and backup of it lives.
Define authorized roles and organization-defined parameters
Name the roles that may access CUI on each media type, such as records custodian, backup administrator or incident responder, and state what each role may do. Rev. 3 uses organization-defined parameters, so you must also set the values that the requirement leaves open, including who approves access and how the approval is recorded. If a federal agency has specified these values in the contract, use them. The output is a role matrix, signed by the system owner, that links each role to media types and permitted actions.
Document the media access policy and procedure
Write the media protection policy and the operating procedure for granting, changing and removing access to CUI on media. The procedure should describe who submits a request, who approves it, which system or physical control applies, and where the record is kept. Your security leadership approves the policy, and the procedure is owned by the team that performs the work. The output is a signed policy and a procedure that staff can follow without asking the author for interpretation.
Enforce restrictions through system and storage controls
Apply the role matrix in the systems themselves. Use directory group membership, file-share permissions, locked cabinets and key control for physical media, and restricted backup administration accounts. For encrypted storage, confirm that keys are released only to authorized roles. Nextcloud server-side encryption protects file contents at rest with keys held on the server, but it does not hide file names or folder structure, so access control on those folders still needs to be set deliberately. The output is a configuration record and test results showing that an unauthorized account cannot reach the protected media.
Set up approval and revocation records
Create the request, approval and revocation forms or tickets that the procedure requires, and make sure each grant of media access has a named approver, a stated purpose and an end condition. Revocation should be triggered when a person changes role or leaves, and the record should show the date and the person who removed the access. The output is a log that ties every access grant to an approval and every removal to a closure record. Test it by sampling a few grants and checking that the paper trail is complete.
Schedule access certification of media access
Set a recurring review in which designated reviewers confirm, change or revoke each access item for CUI media. midPoint access certification campaigns support this by giving reviewers a set timeframe to keep, change or revoke role assignments, which also helps counter access accumulation and supports segregation of duties. Confirm the review interval with your own policy and with the assessor, because the requirement does not fix one. The output is a campaign record listing reviewers, decisions and follow-up actions.

Which evidence passes a 03.08.02 review

An assessor testing 03.08.02 looks for proof that CUI on system media is restricted to authorized people or roles, and that the restriction is documented, configured, approved and reviewed. The six artifacts below connect policy to configuration to records, so each one supports the others when the assessor samples them.

Media access policy and procedures

The written policy states which system media hold CUI, who may access them and how access is granted, changed and removed. The assessor reads the procedures for media access restrictions first, because the SP 800-171A examine objects for 03.08.02 name them directly. Keep each version dated, record the approver, and review the document on a fixed schedule and after any change to the system boundary. Confirm that the policy is the same document referenced in your System Security Plan.

Role-to-media authorization matrix

This matrix maps each role to the media classes it may access, such as removable storage, backup tapes or printed CUI, and names the owner of each mapping. It is the document an assessor uses to test whether access matches authorization for a sampled user. Export the matrix from the identity system where possible rather than maintaining it by hand, and attach a change ticket to every revision so the history shows who approved each change and when.

Access control configurations and exports

Screenshots and exports show the access restrictions actually in force on storage, backup and media-handling systems. Examples include group membership on file shares, encryption key access policies and the permissions on backup repositories. Schedule exports at a fixed interval and store them with timestamps, so the evidence matches the period under review. Test a sample of accounts against the matrix, since a configuration that differs from the authorization is a finding even when the policy is correct.

Access request and approval records

Tickets for each grant, change and removal of media access show that the authorization process runs in practice. Each record should name the requester, the role, the approver and the date the access took effect. Assessors often pick a recent joiner or role change and trace it from request to configuration, so confirm that the ticketing system and the identity system agree. Keep the records in the same system that enforces the approval, and close tickets only after the access change is verified.

Access certification campaign results

Periodic certification campaigns show that someone checks whether current media access is still justified. In midPoint, designated reviewers decide within a set timeframe whether to keep, change or revoke access items such as role assignments, which counters access accumulation over time. Keep the campaign definition, the reviewer list, the decisions and the revocations as dated records. Confirm the campaign scope includes media access roles, not only application access.

Interview notes and custodian training records

The SP 800-171A assessment uses interviews with personnel who hold system media protection responsibilities and with information security staff. Prepare short notes from custodian walkthroughs and keep training completion records showing that custodians understand the restrictions. Assessors compare what custodians say with what the configurations and policy show, so the notes should describe real handling steps, such as how a removable drive is issued and logged. Update the training records whenever the procedures change.

What restricting media access costs in money and effort

This table breaks down the main cost components of meeting 03.08.02 Media access, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. No fee or duration figures were supplied for this requirement, so use the right-hand column as a list of what to request in a written quote from your implementation partner, your auditor or your tool vendors.

Cost component	One-time or recurring	What drives it, and how to keep it down
Access control tooling and licenses	Recurring (if commercial)	Commercial identity governance, DLP or media-control products are typically licensed per user or device. Self-hosted open-source options such as midPoint avoid license spend, though deployment and support effort remain. Ask for license terms in writing.
Key management for encrypted media	One-time setup, then recurring operation	Encryption keys used to protect CUI on media need a managed store. OpenBao is MPL-2.0 licensed and self-hosted, so license spend is avoided. Cost grows with the number of key holders and rotation policy. Confirm FIPS-validated options separately.
Engineering time to configure access restrictions	One-time, plus change effort	Effort depends on how many media types, storage locations and user groups must be restricted, and whether roles already exist. Reuse existing directory groups and define roles before configuring. Request a fixed-scope estimate with stated assumptions.
Policy and procedure writing	One-time, then periodic review	The media protection policy and procedures for access restrictions must be written and approved. Scope grows with the number of systems and sites. Reuse one template across the media family. Ask who signs the document and how often it is reviewed.
Evidence upkeep	Recurring	Access lists, role assignments, review records and tickets must stay current for an assessor to test them. Automate exports where possible and assign an owner. Ask the partner which artifacts are produced automatically and which need manual collection.
Access certification reviews	Recurring	Periodic reviews where designated reviewers keep, change or revoke access items reduce accumulated access. Frequency and reviewer count drive effort. Schedule reviews to match existing staff and role change cycles.
External review or testing	Recurring or per engagement	Independent testing of media access controls, scoped to the systems that hold CUI, adds cost. Scope is set by system count and test depth. Request a written scope, deliverables and timeline before work starts.
Assessor and auditor sampling	Per assessment	Assessors examine samples of access records, interview personnel and may test mechanisms. More systems, more personnel and more role changes mean larger samples and more time. Ask the assessor for its sampling approach before fieldwork.

Which open-source tools can support media access evidence

Restricting access to CUI on system media produces evidence in three places: the encryption that protects stored files, the key material that unlocks them, and the periodic review of who still holds access. The three tools below each cover one of those places, and none of them satisfies 03.08.02 alone. Your organization owns the access decisions, and an assessor will test whether the tools behave as your documented procedures say they do.

Nextcloud file encryption

Nextcloud's server-side encryption protects file contents at rest on local and external storage, with keys held on the server. It does not encrypt file names or folder structure, so anyone with access to the storage layer can still see what exists and how it is organized. Your media access evidence must therefore show who can reach the file store, through which roles, and how folder-level sharing is restricted and logged. Confirm the encryption module setup, key handling and sharing settings in your own deployment before you describe them in your system security plan. Treat metadata as an access control gap until your procedures cover it.

OpenBao transit encryption

OpenBao's transit secrets engine encrypts and decrypts application data without storing that data in OpenBao, and it signs and verifies data. It supports versioned encryption keys with key rotation, which gives you a documented record of which key version protected which content and when keys were replaced. Use it to show key control evidence: who may call encrypt and decrypt operations, how policies limit those roles, and how rotation is performed and logged. Confirm that your integration design, policy definitions and audit logging meet your own requirements, because the engine protects data only where your applications call it.

midPoint access certification

midPoint access certification campaigns assign designated reviewers who must decide, within a set timeframe, whether to keep, change or revoke access items such as role assignments. This counters access accumulation, where people keep rights from earlier roles, and supports segregation of duties between those who request access and those who approve it. The campaign records give an assessor dated review decisions tied to named reviewers, which is the periodic evidence that media access restrictions remain current. Confirm the reviewer assignments, campaign schedule and remediation steps match the people and roles that your procedures actually authorize.

Who owns 03.08.02 in-house and what a partner or auditor does

The organization owns requirement 03.08.02 in full. Under the nonfederal organization's own control environment, its leadership decides which roles may reach CUI on system media, approves each exception, and keeps the records that show those decisions were made. The assessor will interview these people, so they must be able to explain why each role has access and who signed off. Access restrictions also have to hold day to day, which means the internal team runs the reviews that remove access nobody still needs.

Role decisions: Name the roles authorized for CUI on media, such as custodians, engineers or records staff, and write down what each may do.
Approvals: Record who approved each grant, change and exception, and when.
Access reviews: Schedule and complete periodic reviews of who holds media access, and act on the results.
Policy and procedures: Maintain the media protection policy and the procedures for restricting media access, since the assessor will examine both.
Interview readiness: Make sure staff with media protection and information security duties can explain the process accurately.

Confirm with your contracting office or sponsoring agency which parts of the Rev. 3 organization-defined parameters for this area you must set yourself.

Where organizations fall short on media access and how to close it

Most gaps under 03.08.02 Media access are not missing policies. They are shared accounts, unrecorded approvals and settings that do not match the written rule. Each card names one gap, the fix and the evidence an assessor will ask to see.

Shared accounts on media stores

When several staff use one account to reach a file share, backup repository or encryption key store holding CUI, no one can show who accessed what. Assign each person a unique account and grant access through roles tied to the media restriction procedure. Evidence to collect: the account list for each store, role membership exports and access logs that resolve to a named individual. Check that service accounts are documented with an owner and are not used for interactive logins.

Backups copied outside the restricted set

Nightly or weekly backup jobs often copy CUI to a second location that has looser permissions than the source system. The restriction on the source does not carry over. Build the backup target into the same access model, then test that an account outside the authorized roles cannot read a restored file. Evidence to collect: the backup job inventory, permission listings on each target and a restore test record showing who was allowed to perform it.

No record of who approved access

Access to media is often granted by a verbal request or an email that is later lost. An assessor interviewing personnel with media protection responsibilities will ask who may approve access and where that decision is kept. Use a ticketed request that names the requester, the approver, the media and the role granted. Periodic access certification, where a designated reviewer keeps, changes or revokes each item, can confirm that old grants are still justified. Evidence to collect: approved requests, review campaign results and revocation records.

Removable media used without an owner

Flash drives and external disks move CUI out of the monitored environment, and an unlabeled device has no accountable person. Restrict which media types can connect, and tie each permitted device to a named owner who is authorized for the data. Confirm the restriction in the endpoint configuration rather than relying on a memo. Evidence to collect: the device control policy export, the device register with owners and a sample of blocked connection attempts from the endpoint logs.

Policy that no system setting enforces

A media access policy can exist on paper while the systems still allow any authenticated user to open CUI. Assessors test whether mechanisms support or implement the restriction, so a written rule with no matching configuration fails the test method. Map each policy statement to a concrete setting, such as group-based permissions or encryption with keys available only to authorized roles. Evidence to collect: configuration exports, permission reports and a documented test showing an unauthorized user is denied.

Questions buyers ask about 03.08.02 cost, effort and outside help

How much effort does 03.08.02 take compared with the other media protection requirements?

Media access is usually one of the lighter media protection requirements to evidence, because it has a single determination statement in SP 800-171A Rev. 3, while the Rev. 3 family has several requirements with their own organization-defined parameters. The effort is less about the technical control and more about proving that the policy, the access restrictions and the assignments exist and work. Effort rises when media inventories are incomplete or when many people hold broad access to file shares and removable storage. Ask a partner to separate the effort for 03.08.02 from 03.08.01, 03.08.03 and 03.08.07, since they share evidence and are often scoped together. Confirm the weighting with your contracting agency or assessor, because the effort depends on your environment.

Can an organization meet 03.08.02 without an outside partner?

Yes, an organization can meet 03.08.02 with its own staff, since the requirement is to restrict access to CUI on system media to authorized personnel or roles. The organization owns the control, the policy and the evidence. Outside help is most useful when internal staff lack time to build the access model, map where CUI sits on digital and non-digital media, or prepare evidence in the form an assessor will examine. An implementation partner prepares systems and evidence, but only an independent assessor issues results. Whether you need outside help depends on your size, your current access model and the assessment you face, so confirm the expected assessment method with the agency or assessor before deciding.

What does the work need from our staff?

The work needs input from people who own media, identity and access decisions, and from people who will be interviewed about them. Assessors use interview objects for 03.08.02 that include personnel with system media protection responsibilities and personnel with information security responsibilities. Plan time for the people who define roles, approve access and maintain the media protection policy and procedures, since those documents are examined. Access reviews also need named reviewers who can confirm or remove access. Staff should be ready to show how access restrictions are implemented on storage systems, not only describe them. Ask any partner to list the roles it needs from your side and the hours it expects each one to commit.

How does 03.08.02 relate to 03.13.08 and encryption?

03.08.02 limits who can access CUI on media, while 03.13.08 covers protecting the confidentiality of CUI in transmission and storage. The Rev. 3 discussion of 03.08.02 refers to 03.13.08, so the two requirements are meant to be read together. Encryption does not replace access restriction. For example, Nextcloud server-side encryption protects file contents at rest with keys kept on the server, but it does not encrypt file names or folder structure, so access controls still matter for those. OpenBao's transit secrets engine can handle encryption and key rotation for application data, and midPoint access certification campaigns can show that reviewers confirm or revoke access. Confirm with your assessor how they expect encryption and access evidence to be presented together.

Do Rev. 2 and Rev. 3 treat 03.08.02 differently?

The substance is essentially the same. NIST's change analysis traces 03.08.02 to Rev. 2 requirement 3.8.2 and classifies the change as not significant, meaning editorial only. The practical difference is the contract. CMMC Level 2 uses the Rev. 2 requirements, and it assesses 3.8.2 as MP.L2-3.8.2 worth 3 points in the scoring methodology, with a POA&M not allowed for that item under Conditional status. The DoW's current class deviation names Rev. 2 explicitly, while a proposed FAR rule would require Rev. 3 with ODP values published by the DoW CIO. Confirm which version your contract names with the contracting officer before you build evidence.

What should we ask a partner for in a fixed-scope quote?

A fixed-scope quote should state the scope, deliverables and timeline in writing before work starts. Ask the partner to name the systems, media types and locations in scope, including backups and removable media. Ask which requirements are covered, such as 03.08.02 alone or with its sibling media requirements, and which SP 800-171A Rev. 3 objects the deliverables address. Ask what evidence will be produced, what the client must supply, and what is excluded, such as the assessment itself. Ask how changes to scope are priced and approved. Remember that only an independent assessor issues reports or certificates, so the quote should not promise an outcome of any assessment.

Who pays for what when meeting 03.08.02?

The organization pays for its own staff time, its policy work, its storage and identity systems, and any licenses it needs. An implementation partner is paid for the work in its written scope, such as configuring access restrictions, preparing evidence and documenting procedures. An independent assessor is paid separately for any assessment or certification work, and the agency or contract may set when that is needed. Some costs are one-time, such as building the access model, while others recur, such as periodic access reviews and policy updates. Ask a partner to show which costs are one-time and which are ongoing, and confirm assessment fees with the assessor.

How DeployOpen works on this

DeployOpen plans and implements the self-hosted open-source systems that hold CUI, then prepares the media access evidence an assessor will examine, interview and test for 03.08.02 Media access. The organization still owns its access restrictions and decides who is authorized, while DeployOpen prepares the systems and documentation that show those decisions are enforced.

How we scope

Written scope lists every system, repository and storage location holding CUI that falls under media access restrictions.
Scope names the authorized roles and the personnel who administer media access, so interview evidence is defined before work starts.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.

How we build

Role-based access restrictions are configured on file stores and removable or attached media used for CUI within the client's environment.
Encryption of stored CUI and key handling are set up with reference to 03.13.08, which the Rev. 3 discussion of this requirement points to.
Access reviews are configured so designated reviewers can keep, change or revoke access items on a set timeframe.

How we hand over

Documentation covers the media access procedures, access control policy and the mechanisms used to restrict media access.
Test records show restricted users are denied access to CUI media and that authorized roles can still reach it.
Evidence is mapped to the examine, interview and test objects of 03.08.02, so the organization and its assessor can trace each item.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Access review records and configuration changes are kept current as personnel and roles change.
The organization confirms its assessor, its system security plan entries and any plan of action and milestones with its own contracting authority and assessor.