03.08.04 Media marking: requirements and evidence

What 03.08.04 media marking asks for and why assessors test it

When an assessor or contracting officer asks how you protect CUI on removable drives, backup tapes or printed reports, they want proof that the media itself announces what it holds. Media marking under 03.08.04 requires that system media containing CUI carry visible indicators of distribution limitations, handling caveats and the applicable CUI markings. The point is practical: a person who picks up an unlabeled drive or a stack of printouts cannot know they must be stored, shared or destroyed under CUI rules unless the label tells them. Without marking, correct access restrictions in 03.08.02 and correct transport handling in 03.08.05 depend on memory and goodwill, which is why assessors treat marking as the first visible sign that the rest of the media program works.

Marking is harder in practice than the wording suggests. Organizations hold mixed media (laptops, shared network folders, exported spreadsheets, email attachments, printed drafts), and each carries a different marking method. Legacy archives often contain CUI that was never labeled, and staff may apply banners inconsistently or use their own abbreviations. Before an assessment, confirm which CUI categories and markings your contracts and agreements require, decide which media types you will mark and how, and identify where unmarked legacy data sits. Ask your team to show examples of marked media from each system, since a written procedure alone rarely satisfies an examiner.

NIST lists MP-3 from SP 800-53 Rev. 5 as the source control for 03.08.04, which is useful when you map your own control library to the Rev. 3 requirement. The change from Rev. 2 is editorial only: NIST's change analysis traces the requirement to Rev. 2 requirement 3.8.4 and classifies the change as not significant. If you already marked media to meet Rev. 2, your existing practice carries over, but you should still re-check it against the Rev. 3 assessment objectives in SP 800-171A Rev. 3, which name examine, interview and test methods for this requirement.

Which media and systems fall under 03.08.04 marking

Marking work expands or shrinks with a handful of scoping choices: which media hold CUI, which systems produce CUI output, and which outside parties receive marked media. Settle these decisions before writing procedures, because each one sets how many marking points, labels and handling records the organization must maintain.

Removable and portable digital media

USB drives, external disks and optical discs that hold CUI are the most common marking gap because they leave the system and are often copied without a record. Decide which device types are permitted at all, then mark every permitted device that carries CUI with its distribution limitation and handling caveat. Check whether marking is applied to the media itself, to the file system volume, or to each file, and document the method you choose. Confirm the approach with your assessor before rollout.

Backup and archive media

Backup tapes, snapshots and archive volumes repeat CUI that already exists on production systems, so each copy needs marking that matches its source. Map every backup set and archive location to the CUI category it contains, not only to the system that created it. Retention periods can leave marked copies in place long after the original file changed, so include archive media in your inventory and review cycle. Ask your backup provider how labels or metadata travel with restored data.

Exported files and printed reports

Exports from line-of-business applications, spreadsheets emailed to colleagues and printed reports often lose the markings applied in the source system. Identify the export functions, report templates and print paths that can produce CUI, then configure them to add the marking automatically where the platform supports it. Printed pages need a header or footer marking and must be tracked as non-digital media under the same rules. Confirm which export paths your platform can mark and which need a manual step.

Systems that generate CUI output

Reporting engines, ticketing systems, document management platforms and data warehouses create new CUI records that never existed as marked files. Inventory each system that produces CUI output and document how its output receives the marking, whether through templates, metadata fields or access-based labeling. Systems that generate output without any marking mechanism will need a configuration change or a compensating procedure. Record each decision in the system security plan so the scope is traceable.

Third parties that receive marked media

Contractors, cloud providers, couriers and sub-tiered suppliers that receive CUI media must keep the markings intact and understand what they mean. Include the marking requirement in contracts and flow-down terms, and state which parties may remove or change a marking. Ask each recipient how they store and return marked media, because a marking that is lost at the receiving end breaks the chain of control. Maintain a register of external recipients and review it when suppliers change.

How an assessor tests media marking under SP 800-171A

This table compares the three SP 800-171A determination statements for media marking with the examine, interview and test objects an assessor uses for each, the evidence to have ready, and the gaps that most often appear. Read it as a preparation checklist: each row shows what the assessor will look for and what you should be able to produce.

Assessment element	What the assessor checks	Evidence requested	Common findings
Determination statement 1: marking procedures	Whether documented procedures direct personnel to mark system media that contain CUI with distribution limitations, handling caveats and applicable CUI markings	Media protection and physical protection policy, marking procedures, and the list of marking security attributes in use	Procedures exist but do not name the CUI categories or the marking values staff should apply
Determination statement 2: marking responsibilities	Whether the people who apply markings, and those who oversee information security, know their marking duties	Interview notes with media protection and marking personnel, role assignments, and training records covering marking	Staff describe marking inconsistently, or the marking role is assumed rather than assigned
Determination statement 3: marking mechanisms	Whether marking processes and the mechanisms that support them actually work on system media in the environment	Sample of marked media or system outputs, marking process walkthrough, and configuration showing how markings are applied	Markings are missing on removable media, backups or exported files, or labels are applied by hand with no check
Examine method	Reviews documents and records that define marking behavior	Policy and procedure documents, marking security attribute list, version history and approval dates	Documents are outdated, unapproved, or do not match what staff do
Interview method	Asks responsible personnel how marking works in practice and who is accountable	Named owners for marking, a short description of the marking workflow, and escalation contacts	Interviewees point to different owners or cannot explain the caveats they apply
Test method	Observes or exercises marking processes and the mechanisms that support them	Screenshots or exports of marking settings, samples of marked media, and test records of marking checks	Test samples are not representative, or the team cannot reproduce marking on demand

How to implement media marking in order

This sequence turns the 03.08.04 requirement into a working marking practice: the organization decides what its markings are, writes them down, applies them to every media type and output path, trains the people who apply them, and checks that the labels actually appear.

Define the CUI categories and caveats in use
Start by listing the CUI categories your organization handles and the distribution limitations and handling caveats that apply to each one. The owner is usually the information owner or security lead, working from the contracts, agreements and CUI registry entries that govern your data. Confirm the exact marking text against the authoritative CUI guidance for each category rather than relying on memory or older examples. The output is a short, approved register that maps each category to its required banner, designation indicator and limitation statement. You know this step is done when every CUI type in your environment appears in the register with an owner.
Write the media marking procedure
Next, write a procedure that tells staff how marking is applied, who applies it, when it must be applied and who approves exceptions. It should reference the category register and the policy controls for media protection, so auditors can trace it back to the requirement. Assessors examine this procedure directly, so it needs a document owner, a version and an approval date. The output is a signed-off procedure stored in your controlled document repository. The step is complete when someone outside the security team can follow it and produce a correctly marked label without help.
Map marking rules to each media type
Decide which marking method applies to each kind of system media that can hold CUI, including removable drives, backup tapes, printed pages, optical discs, mobile devices and media that leave controlled areas. For each type, record whether the marking is a label, a header or footer, an embedded file property, a container tag or a physical sleeve, and who is responsible for applying it. Where a medium cannot carry a visible marking, document the compensating control, such as a tagged container or a case label. The output is a media-to-marking matrix that the procedure points to. The step is done when every media type in your inventory has a row with a named method.
Build markings into print, export and copy workflows
Markings fail most often when they depend on a person remembering to add them. Configure your systems so that CUI markings are added automatically or prompted where possible, for example through document templates, print header and footer settings, file classification labels, or export templates in your collaboration platform. Confirm with each vendor which marking features the product supports, because capabilities differ by product and version. Test copies, exports and printouts, not only the original file. The output is a list of workflows with the mechanism used for each one and a test record. The step is done when a sample from each workflow carries the expected marking.
Train staff who create, handle and release CUI
Train the people who create, label, copy, move and release CUI media, and the people who receive it, on the register, the procedure and the workflows they will use. Include the operational detail, such as what to do when a file arrives unmarked and who to contact. Record attendance and the version of the material covered, so you can show who was trained on which procedure and when. The output is a training record tied to the current procedure version. The step is done when each named role in the media-to-marking matrix has a completed training record.
Verify markings with periodic spot checks
Finally, check that the markings are actually present and correct. Pull a sample of media and outputs from each workflow and compare the markings to the register, recording any gaps, the cause and the corrective action. Repeat the checks on a schedule your organization sets and documents, and feed the findings into your plan of action for the broader system. Assessors commonly ask for this evidence, so keep the check records, not just a statement that checks happen. The output is a dated log of spot checks with results and remediation. You know the step is working when findings decline over successive checks and each gap has a closed record.

How marking works on digital media, paper and system outputs

Marking only holds up when every copy carries its markings through the mechanism that fits the format. For 03.08.04, the organization decides how each type of media is marked. On digital documents that means header and footer banners that state the CUI designation, distribution limitation and handling caveat, backed by file metadata fields that tools and people can read without opening the file. On physical media such as USB drives, optical discs, tapes and hard drives, the mechanism is a label or tag affixed to the media and, where the medium is a container, to its case or sleeve. On paper, the banner goes on every page, including the cover and any attachments. Reports and exports generated by systems need the same treatment: the report template or output configuration should insert the banner automatically so a printed or exported page cannot leave the system unmarked.

The harder problem is what happens after data leaves its original file. Copying a marked paragraph into an unmarked document, exporting a table to a spreadsheet, or deriving a summary from CUI can strip the banner while the content remains controlled. Organizations usually address this with a rule that derived material inherits the highest marking of its sources, plus a check at the point of export, such as a template that refuses to save without a banner or a review step before release. Test this with real workflows: take a marked file through each common path (copy, print, export, email attachment, screenshot) and record whether the marking survives.

Before writing any marking rule, confirm the CUI categories, marking authority and distribution limitation wording that apply to your contracts with the contract itself and the National Archives CUI Registry, because those sources, not the NIST standard, define the markings. The system owner and the information security office should then agree on which mechanism applies to each media type and who approves exceptions. Those decisions become the procedures that an assessor will ask to see under the media protection policy and the procedures for media marking.

Evidence that passes a media marking review

An assessor testing 03.08.04 looks for a documented marking practice, proof that people follow it, and proof that the practice still works today. The cards below cover the artifacts that show each of those things, along with how to keep each one current between assessments.

Media protection and marking procedures

The written procedures define how system media containing CUI are marked with distribution limitations, handling caveats and the applicable CUI markings. Assessors look for procedures that name the roles responsible for marking, the point in the media lifecycle where marking happens, and what happens when media arrive unmarked. Tie the procedure to the media protection policy so the two stay consistent. Review the document at least once a year and after any change to the CUI categories the organization handles, and record the review date and approver in the document itself.

List of marking security attributes

This is the inventory of the security attributes the organization uses to mark media, such as the CUI category, the limited dissemination control and the handling caveat, along with the values allowed for each. Assessors compare this list against the procedures and against what the systems actually apply. Keep it under version control so every change shows what was added or retired and who approved it. When a new CUI category enters scope, update the list before any media carry it.

Samples of marked media

Assessors commonly ask for a sample of media containing CUI and check that the markings match the attributes list and the procedure. Keep photographs or scans of representative labels, banners or file headers, dated and tied to the media inventory entry they describe. Include at least one example of a correction, such as a label replaced after an error, so the reviewer can see the process working. Refresh the samples whenever the marking format changes, because old samples that no longer match the procedure weaken the whole package.

Marking configuration screenshots and templates

Where marking is automated, such as document headers, banner templates in a file server or labels generated by an asset system, the configuration itself is evidence. Capture the settings that enforce the markings, the template files and the account that can change them. Record the platform version and the date of each capture, since a screenshot without a date proves little. Store the configuration files in a repository with change history, and confirm that the platform's own audit log records edits to marking templates. Check the vendor documentation for the exact export options before you rely on them.

Training records for marking responsibilities

Personnel who mark, handle or receive CUI media need to be trained on the marking rules, and assessors interview them to confirm they understand those rules. Keep attendance records, course content and completion dates for each role, and link them to the people listed in the marking responsibilities. Refresh training when procedures or CUI categories change, not only on a fixed calendar. Interview answers that contradict the training content are a common finding, so review the training material against the procedure before each assessment.

Exception and correction logs

Unmarked or incorrectly marked media, and any approved deviation from the marking procedure, should appear in a log with the date, the item, the corrective action and the approver. An empty log can raise questions about whether anyone checks marking at all, so the log should show how errors were found and closed. Review open exceptions at a set interval and close them with evidence. Ask your assessor early how they expect exceptions to be presented, because the answer varies with the scope of the assessment.

What meeting media marking costs in money and effort

This table breaks down the cost components of meeting 03.08.04 media marking, who is paid for each, and whether the cost is one-time or recurring. Use it to see which parts you can do in-house with self-hosted open-source tooling and which parts a quote should price separately. No fees or durations are given because none were supplied for this requirement.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it up or down
Marking template and label design	Internal staff or implementation partner, for the marking standard and document templates	One-time, with periodic revision	Number of system media types and CUI categories in use; fewer templates is cheaper to maintain
Tooling for marking and workflow	Engineering time; open-source wiki or document platforms are often license-free, but setup and hosting are not	One-time build, recurring hosting and patching	Whether marking is enforced in the platform or handled by manual procedure; confirm license terms for each product
Engineering time to build marking into workflows	Internal platform engineers or an implementation partner under a fixed-scope agreement	One-time	Number of systems that create or export CUI and how many media-handling paths need marking logic
Staff training on marking rules	Internal training owners, or an external trainer if the organization buys courses	One-time for initial training, recurring for new hires and refreshers	Workforce turnover, number of roles that handle media, and how often CUI categories change
Evidence upkeep	Internal compliance or security staff who keep marking procedures, samples and attribute lists current	Recurring	Change frequency of media types, version control discipline and how much marking evidence must be retained
Internal review and self-assessment	Internal security or compliance staff reviewing marked media samples against the marking procedure	Recurring, usually at each assessment cycle	Sample size chosen, number of sites and whether checks are manual or automated
External review or readiness check	Independent consultant or implementation partner, quoted from written scope	One-time or per assessment cycle	Breadth of scope, number of systems in the boundary and how much remediation is expected
Assessor time	Independent assessor or government assessor, depending on the contract path	Per assessment	Assessment type, number of examine, interview and test objects and readiness of evidence on arrival

Who owns marking, who can help, and where the auditor stops

Your organization owns the controls for 03.08.04. Your team decides which system media hold CUI, which distribution limitations and handling caveats apply to them, and which CUI markings must appear on each category of media. Those decisions depend on your contracts, your CUI categories and the rules your federal customer has set, so they cannot be delegated to a vendor. Your team also trains people to apply the markings and checks that they do.

Marking rules: Define which media types require markings, which markings apply to each CUI category and who approves exceptions.
Labels and templates: Own the approved label text, placement standards and the marking vocabulary used across departments.
Training: Make sure personnel with media protection and marking responsibilities know the rules and can explain them.
Accountability: Name the owner of the marking policy and the procedures that implement it.
Ongoing review: Confirm marking practice still matches the CUI in your environment after contract or system changes.

Check that each rule has a named owner, a date of last review and an approver outside the team that applies it.

Where media marking usually fails an assessment

Media marking under 03.08.04 is simple to describe and easy to get partly right, which is why assessors tend to find gaps at the edges: new teams, old media, outputs and paperwork. The cards below cover the failures we see most often, each with a closing action the organization can check before an assessment begins.

Marking applied inconsistently across teams

Each team often marks CUI in its own way, with different banner text, label placement or abbreviations. An assessor testing 03.08.04 will sample media from several groups and compare them against the marking procedure. Check that every team uses the same markings, drawn from one agreed list, and that the list matches the CUI categories the organization actually handles.

Legacy media left unmarked

Drives, tapes, binders and archived shares created before the marking procedure existed often carry no markings at all. These items still hold CUI and fall within the requirement. Inventory older media and mark or re-label it, or document why it is no longer CUI and has been dispositioned. Confirm the disposition route with the sanitization procedure under 03.08.03.

Markings missing from exports and printouts

Markings are often applied to the source document but lost when the content is exported to a spreadsheet, extracted to a CSV, or printed from a reporting tool. The copy that leaves the system is the one that most needs the marking. Test a sample of exports, reports and printouts from the systems that handle CUI and confirm the distribution limitation and CUI marking appear on each.

Procedures that do not match practice

A marking procedure that describes an ideal process, while staff use shortcuts, is a finding in its own right. Assessors compare the written procedure against interviews and observed practice, and the examine and interview methods in SP 800-171A are designed to catch exactly this gap. Walk through a real marking task with the people who perform it and update the procedure to match what they do, or change practice to match the procedure.

No evidence of marking training

Staff who create or handle CUI need to know which markings to apply and why. Without training records, the organization cannot show that the people responsible for media marking were told what to do, even when the marks themselves look correct. Keep dated training records for each role that marks media, and link them to the current marking procedure version so the assessor can see which guidance each person received.

Media marking questions buyers ask before hiring help

How much effort does media marking take to implement?

Most of the effort sits in defining the marking rules, not in applying the labels. The organization has to decide which system media hold CUI, which CUI categories and distribution limitations apply, and how handling caveats are written so that people and systems apply them the same way. The work then covers updating the media protection policy and procedures, configuring labeling on the systems that produce or store CUI, and training the people who create and handle media. Effort rises with the number of data sources, the variety of media types, and the number of teams that generate CUI. Ask any partner to break the estimate into policy, configuration, training and evidence collection, and to state which items it assumes you already have in place.

Can our internal team handle media marking without outside help?

Often yes, if the team understands CUI markings and has authority over the systems that label and store data. The assessment method for 03.08.04 looks for policy and procedures, personnel who hold marking responsibilities, and mechanisms that support marking, so the work is mostly documentation, configuration and interviews. Internal teams usually struggle in three places: interpreting the CUI categories and their marking rules, configuring labels consistently across platforms, and producing evidence that shows the control operates over time. Outside help is most useful for the configuration and evidence work. Whatever you choose, the organization keeps ownership of the control and the contractual responsibility for it.

What does a partner need from our organization to start?

A partner needs access to the people and systems that handle CUI, and a clear statement of what the contract requires. Expect to provide:

Current media protection and CUI handling policies, even if they are incomplete
A list of systems, repositories, and removable or non-digital media that hold CUI
Names of the people who create, approve, store, and transport CUI
Examples of existing markings, templates, and document classification settings
Written direction on which CUI categories and distribution limitations apply, from the contract or the data owner

If the organization cannot answer the last point, the marking rules must be settled first. A partner can prepare systems and evidence, but it cannot decide which information is CUI or which markings apply.

How long does media marking take to put in place?

The schedule depends on how many systems and media types must be covered, and on how quickly the organization can agree on its marking rules. Sign-off from the contracting officer or data owner, changes to labeling tools, and training rollouts are the usual bottlenecks. No supplied source gives a duration for this control, so ask any partner for a timeline built from the written scope, with each dependency named. Ask which parts depend on your decisions and which depend on tooling changes, so you can see where delays would come from.

Does applying CUI markings alone satisfy 03.08.04?

No. Marking is one part of the requirement, and the assessment looks for more. An assessor will expect a documented media marking procedure, a list of the system media marking attributes, personnel with clearly assigned marking responsibilities, and evidence that the marking mechanisms work in practice. A label on a file that is not tied to a documented procedure, or that people apply inconsistently, will not show that the requirement is met. Marking also has to connect to related controls, such as media storage, access, and transport, because marked media that is handled without controls still exposes CUI. Ask your assessor to confirm the evidence they expect for each determination statement.

What changes if the FAR proposed rule sets the requirements?

The proposed FAR rule would require contractors handling CUI to comply with SP 800-171 Rev. 3, using organization-defined parameter values published by the DoW CIO. The rule was not final as of October 2026, so treat it as a planning signal rather than a settled requirement. If it is finalized as proposed, the marking control would be assessed against Rev. 3 wording, and any organization-defined values for marking would have to match what the agency publishes. Meanwhile, DFARS work in DoD contracts currently names Rev. 2. Confirm with the contracting officer which revision applies to each contract, and ask any partner how it would track changes to the parameter values.

What evidence should we expect a partner to prepare for marking?

Expect evidence that shows the rules exist, are configured, and are followed. Typical items include:

The media protection policy and the marking procedure, with version history and approval records
Screenshots or exports of labeling settings and templates in document and file systems
Records of training for people who create or handle CUI
Samples of marked media, with the marking applied correctly
Records of review or exceptions when a marking was missed

Wiki and documentation platforms such as XWiki keep version history and allow rollback, and BookStack assigns permissions by role, which helps show who may change marking procedures. Confirm these capabilities in your own environment before relying on them as evidence.

How DeployOpen prepares marking evidence for this requirement

DeployOpen starts by fixing the boundary before any marking template is written. The first deliverable is an inventory of the system media in scope for 03.08.04: removable drives, backup tapes, exported reports, print outputs and the repositories where CUI is held, each tied to the system or enclave that stores it. Scope is agreed in writing with the client before work starts, and it names which platforms, owners and media types are covered. DeployOpen does not issue assessment reports or certifications. Independent assessors do, and the client owns the controls and the decisions about what counts as CUI.

Once scope is fixed, DeployOpen configures marking in the client's self-hosted platforms so that the marking is applied by the system rather than left to memory. In a wiki or document platform such as XWiki or BookStack, this usually means page templates that carry the CUI banner, the distribution limitation and the handling caveat, plus role-based permissions so that only authorized roles can publish or export CUI-marked pages. Where the client uses CUI categories defined in its contracts, DeployOpen maps each category to a template and records the mapping. Confirm with the client's contracting officer or program office which CUI markings apply, because the platform can only enforce markings the client has decided on.

The evidence package for the assessor is where most gaps appear. DeployOpen prepares the list of system media marking security attributes that the SP 800-171A Rev. 3 examine method expects, the media protection and marking procedures, and exports of template and permission configurations showing who can apply or override markings. It also records version history for changed templates, since the version control in platforms such as XWiki lets a reviewer see what changed, when and by whom. Plan interview time for the personnel who handle media, because the assessor will ask them to explain the marking steps, not only to show the procedure.

03.08.04 Media marking