What 03.08.05 media transport asks for and why it is hard to evidence
03.08.05 requires you to protect and control system media that contain CUI while it is transported outside controlled areas, keep accountability for that media in transit, and document the activities associated with its transport. For a contractor, that means a drive, tape or box of paper with CUI on it cannot simply leave the building on a courier's cart, in a staff member's bag or in a rental car without a record of who had it, where it went and who received it. The risk is ordinary and easy to overlook: media is lost, misdelivered or left unattended far more often in transit than in a locked storage room, and a single unaccounted-for drive can trigger the incident reporting obligations that apply to CUI.
The evidence for this requirement is usually a process record, not a tool setting. An assessor will ask for the transport policy and procedures, the authorized personnel list, a sample of transport logs or chain-of-custody forms, and evidence that couriers, drivers and staff were trained on those steps. They will then interview the people who actually move media and check whether their handoff records match what the policy says. Gaps tend to surface in the mismatches: a log entry with no recipient signature, a tape that left a site with no record, or a courier company used with no documented agreement. Your implementation partner can help design these records and wire them into existing systems, but the organization owns the procedure and must be able to show it operates every day.
Rev. 3 treats this requirement as a significant change from Rev. 2 requirement 3.8.5, because it adds more detailed and more foundational tasks. Confirm the exact Rev. 3 task wording against the NIST publication before you rebuild your procedures, and map each task to a named owner. The Rev. 3 discussion of 03.08.05 points to 03.13.08 (transmission and storage confidentiality) and 03.13.11 (cryptographic protection), so encryption of media in transit is part of the same decision. Decide now whether CUI on portable media will be encrypted with validated cryptography before it leaves a controlled area, because an unencrypted drive that is lost in transit is a much harder incident to close than an encrypted one.
Which media, transport paths and third parties fall under 03.08.05
Under 03.08.05, the boundary is the edge of a controlled area, not the edge of the organization's network. Each item below changes how many transport events an assessor will expect you to account for and document.
Removable drives and encrypted laptops off-site
A USB drive or laptop that holds CUI and leaves a controlled area is a transport event, even when the trip is a short walk to a client site or a home office. Each departure needs an accountability record that shows who carried the media, where it went and when it returned. Check how many staff carry CUI-bearing devices and whether those devices are issued, logged and tracked. Encryption on the device supports 03.13 requirements but does not replace transport records.
Paper and tape couriers
Printed CUI and backup tapes moved by internal staff or an outside courier count as transported media. Document the handoff at each point: the sender, the courier, the recipient and the signature or receipt. Ask whether your courier contract requires chain-of-custody records and whether the courier can produce them on request. A sealed container with a log sheet usually produces far more usable evidence than a verbal confirmation.
Shipments to vendors and cloud backup sites
Sending media to a third party, such as a vendor for data recovery or an off-site backup facility, is transport and also a third-party disclosure. Each shipment should have a documented destination, a named recipient and a record of return or destruction. Confirm in the vendor contract who is responsible for custody in transit and whether the vendor's own handling meets the expectations in 03.08.05 and the related transmission controls in 03.13.08 and 03.13.11.
Employees carrying media home
When staff take CUI media home for remote work, each trip is a transport event that happens outside every facility control you run. Decide whether home carriage is permitted at all, and if it is, define who may do it, what they may carry and how the movement is recorded. Ask whether your remote and hybrid work procedures name this case, because an undocumented exception is the one an assessor is most likely to find.
Counting transport events for the record
The number of documented transport events grows with every device, shipment and trip, so scope decisions drive the evidence workload. Estimate events per month by category (devices, courier runs, vendor shipments, home carriage) before you design the log. A single transport register that captures each event once is easier to maintain than separate records kept by each team.
Inventory that shows where media is
Accountability in transit depends on knowing which media exist and who holds them before they leave. Asset records that list each drive, tape and laptop with its owner and location make it possible to match a transport record to a specific item. Confirm that your asset inventory covers removable media, not only computers, and that it is updated when media move.
How an assessor tests media transport under SP 800-171A Rev. 3
This table breaks down how an assessor works through 03.08.05 under SP 800-171A Rev. 3, covering the determination statements, the examine, interview and test objects, and the findings that usually come up. Read each row as a step the assessor takes, and use the evidence column to check whether your own records would answer it.
| Assessment element | What the assessor checks | Evidence that answers it | Where it usually fails |
|---|---|---|---|
| Determination statements (four) | Whether media containing CUI is protected and controlled during transport outside controlled areas, accountability is kept in transit, and transport activity is documented | Written transport procedure, custody records and transport logs tied to specific media | Statements are answered for storage but not for the trip between locations |
| Examine: policy and procedures | Physical protection, media protection and access control policies that cover transport, and whether they name roles and steps | Approved policy and procedure documents with version history and owner sign-off | Policies say media is protected but do not describe how transport is handled |
| Examine: storage and access records | Procedures for media storage and the authorized personnel list for handling CUI media | Authorized personnel list, storage procedures and access control records for transport roles | List is out of date or does not match who actually carries or signs for media |
| Interview: media storage staff | Whether people who move media know the transport rules and follow the same steps the documents describe | Staff can explain chain of custody, sealing, handoff and what to do if media is lost in transit | Staff describe informal practice that differs from the written procedure |
| Interview: information security staff | Whether security personnel review transport activity, know which media leave controlled areas, and respond to exceptions | Named reviewers, review cadence and records of follow-up on unusual transport | Security staff are not aware that transport is in scope |
| Interview: system developers | Whether people who build or configure systems that hold CUI understand transport requirements for media and backups they produce | Documented requirements passed to engineering and backup teams | Developers ship export or backup workflows that copy CUI to removable media with no transport control |
| Test: storage processes and mechanisms | Whether the processes and mechanisms that store and protect media work as written, including those used when media leaves the site | Demonstrated process, configuration output or tool records showing media is tracked and protected | Mechanisms exist but are not switched on or are not connected to transport steps |
| Common finding: undocumented transport | CUI media leaves a controlled area with no written step covering it | Transport procedure that names carriers, methods and approvals | Couriers, couriers' vendors or staff carry drives home without any recorded step |
| Common finding: no custody record | No record shows who held the media at each point of the trip | Custody log with signatures or electronic handoffs at each step | Logs stop at shipment and resume only at receipt, leaving a gap in transit |
The sequence to implement media transport controls
This sequence turns the 03.08.05 requirement into a working transport process with named owners, protected media in transit, a custody record for every move and tested evidence that the process holds up before an assessor asks for it.
Inventory media types and transport paths
The compliance lead and the system owner list every kind of system media that holds CUI, from laptops and external drives to backup tapes and paper, along with each route it takes outside a controlled area, such as courier runs, shipments to a vendor or moves between sites. Each row records the media type, the data it holds, the origin, the destination and the party moving it. The output is a transport inventory that the later steps reference. The step is done when the system owner confirms that no transport path is missing, including ad hoc hand-carries that staff may not think of as transport.
Write the transport procedure with roles and approvals
The security lead writes a media transport procedure that names who may authorize a move, who may carry media, who receives it and who signs off on exceptions. It sets out when media must be encrypted, when it must travel in a sealed or tamper-evident container and which carriers are approved. The procedure links to the media storage, access and sanitization procedures so that handling is consistent across the lifecycle. The output is an approved, versioned procedure with a named owner. It is done when the people named in it have acknowledged their roles in writing.
Select protection for each transport path
For each path in the inventory, the security engineer selects the protection that the procedure requires. Digital media is typically protected with encryption that is validated for the data involved, and the decision should reference the cryptographic requirements 03.13.08 and 03.13.11. Physical media is protected with sealed containers and approved carriers. Where the organization uses a cloud or managed transfer service, the team confirms how that service protects data in transit and who holds the keys. The output is a protection matrix mapping each path to its controls. The step is done when the matrix has no path left without a stated protection.
Set up the custody and transport log
The compliance lead creates a custody and transport log template that records each movement: the media identifier, the sender, the carrier, the departure and arrival points, the seal or tamper-evidence number, the receiver and any exceptions. The log must be kept in a system the organization controls and protected like other CUI records. Where the organization already runs an asset register, such as GLPI's Assets module, the team can link media records to it, but must confirm that the tool captures the transport fields the procedure needs. The output is the template and a storage location. The step is done when a test entry has been completed and reviewed.
Train couriers and staff on the procedure
The security training lead briefs everyone named in the procedure, including couriers, internal staff who hand off media, mailroom or logistics personnel and system administrators who prepare media for shipment. The training covers the approved protections, how to complete the log, what to do when a seal is broken or a package is late, and whom to report to. Attendance and the signed acknowledgment of the procedure are recorded. The output is a training record for each named role. The step is done when every person who can move CUI media has a current, documented briefing.
Test a sample transport end to end
The compliance lead chooses a representative transport, ideally one covering digital media and one covering physical media, and runs it through the full process: authorization, protection, custody log entries at each handoff, receipt confirmation and closure. The tester records any deviation, such as a missing log field or a seal check that was skipped, and the owner fixes it before the record is closed. The output is a signed test record that shows the procedure works in practice and lists the corrective actions. The step is done when the test record is filed with the transport procedure so that an assessor can examine both together. Confirm with your assessor which sample size and evidence format they expect.
How transport records prove accountability in transit
Protecting media and proving accountability for media are two different jobs, and assessors test both. Protection is what happens to the drive, tape or paper while it moves: it is sealed, encrypted, carried by someone authorized and kept out of unapproved hands. Accountability is the evidence that lets you say, for any given item and any moment of its journey, who had it, where it was and what protection applied. 03.08.05 asks for both, and it also asks that the transport activity itself be documented. An organization can have sound packaging and a trusted courier and still fail the requirement if it cannot reconstruct the chain afterward. Ask your team to name the last three media movements that involved CUI and show the records for each. If the answer takes days, the transport process is not yet auditable.
A defensible transport record ties one media identifier to a sequence of events. At minimum it should capture the media identifier and the CUI it holds, the sender and the recipient by name and role, departure and arrival times, the carrier or courier and the vehicle or handler, the protection applied (for example, encryption status, tamper-evident packaging or a hand-carry instruction), and every custody handoff in between. Each handoff needs a signature or system confirmation from both sides. Gaps in this chain are the usual finding because they tend to appear at handoffs and at the edges of the process: a shipment that left the sender but has no arrival entry, a courier change that was never recorded, or a drive returned to a shelf with no note. Illustratively, a single missing arrival confirmation can leave an assessor unable to say whether the media was ever received, which is treated as a documentation failure even when nothing was lost. Confirm with your carriers which custody data they can supply and in what format before you rely on their logs.
Encryption supports the protection side of this requirement, and it does not replace the log. The Rev. 3 discussion of 03.08.05 points to 03.13.08 (transmission and storage confidentiality) and 03.13.11 (cryptographic protection), so encrypted media and encrypted network transfers are the expected protection for CUI in transit. Encryption reduces the harm if a package goes missing, but it does not show who handled it, when the handoffs occurred or whether the media left a controlled area. Record the encryption method, the key custodian and the key identifier in the transport entry, and keep key material separate from the media. Confirm with your cryptography owner that the methods used meet the requirements your contract or agreement sets, because 03.13.11 concerns the cryptographic protection itself and this page does not assess it.
Evidence that passes a 03.08.05 review
An assessor testing 03.08.05 looks for a chain of evidence: a documented procedure, the parties allowed to carry media, a record of each movement, and proof that the media was protected and the people involved were trained. Each artifact below should be refreshed on a fixed cycle so the package is current when the assessment begins, not assembled in the final weeks.
Media transport procedure
A written procedure that states which media types are covered, what counts as transport outside a controlled area, how media is packaged and sealed, who signs for it, and what happens when a shipment is late or lost. The assessor compares the procedure with what staff actually do, so it should name the systems and forms people use. Review it at least once a year and after any change to carriers, tools or facilities, and record the reviewer and date in the document history.
Approved carrier and courier list
A current list of the internal couriers, external carriers and individuals authorized to transport CUI media, with the controls each one must follow, such as locked containers or tamper-evident seals. Confirm that the list matches the personnel and contractor records used for access decisions. Review it monthly against staffing changes and remove departed staff or expired vendor agreements the same week they lapse.
Transport and custody logs
Records that show each movement of CUI media: the media identifier, the sender, the recipient, departure and arrival times, the handoffs in between, and any seal numbers. A log with gaps is the most common reason an assessor cannot trace media end to end. Keep the log in a system where entries are timestamped and cannot be silently edited, and reconcile open transports against the log every month.
Encryption records for portable media
Evidence that media carrying CUI is encrypted before it leaves a controlled area, linked to the cryptographic requirements in 03.13.08 and 03.13.11. Keep records of which devices or volumes are encrypted, the encryption method, and who holds the keys or passphrases, and keep key custody separate from the media. Check the inventory each month against the devices that actually left the building so that any unencrypted exception is caught and documented.
Training records for transport personnel
Completion records for every person who packs, carries, signs for or receives CUI media, showing the course content, the date, and a passed check where one exists. The training should cover the transport procedure, seal and handoff steps, and how to report a loss. Record training before anyone is added to the approved list, and refresh it on the schedule set in the organization's awareness and training program.
Traced transport sample
A walkthrough of one or more real shipments from the log back to the procedure, the approved list, the encryption record and the training record, with the handoffs confirmed by the people involved. Assessors use this to test whether the other artifacts agree with each other. Run a sample trace each month, document any discrepancy and its corrective action, and keep the traces in the assessment folder.
Which self-hosted tools support media transport evidence
Before media can be tracked in transit, the organization needs a register of the devices and media that hold CUI. GLPI's Assets module records computers, monitors, software, network equipment, peripherals, printers, phones and racks. Entries can be typed in by hand or pushed automatically by the GLPI Agent through the native inventory built into GLPI since version 10. This gives an assessor a starting list to compare against the transport records, but the list shows what the asset is, not where it went or who signed it out.
- Asset records: Each device or peripheral can carry an owner, location and status, which supports accountability for the item.
- Automatic inventory: The GLPI Agent can populate records from endpoints, reducing reliance on manual entry.
- Gaps to close: Removable drives and tapes may need to be recorded manually if they are not detected by an agent.
- Transport records: GLPI does not replace a documented chain of custody for each shipment or hand-carry.
Confirm with your GLPI administrators which asset types, fields and agent configurations your environment will use, and check that the register is reviewed on a schedule you can show to an assessor.
Media transport controls depend on knowing what is installed on the systems that write to or read from media, including encryption and device control software. Wazuh's Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, running processes, services, users and groups, and Windows updates from each endpoint. It stores this in the Wazuh indexer, where the dashboard presents inventory views and reports. This is useful evidence that the baseline on endpoints is known, which is the foundation for asserting that media-handling software is present and current.
- Software inventory: Lists installed applications so an assessor can check for approved encryption or media handling tools.
- User and group data: Shows which accounts exist on the endpoint, supporting the authorized personnel list an assessor will request.
- Running services: Helps confirm that removable media management or backup services are active.
- Report exports: Dashboard reports can be retained as dated evidence for the assessment file.
Confirm that Syscollector reports the specific software and settings your transport procedure depends on, and test it on a sample endpoint before relying on it in an assessment.
Where CUI is copied from a Nextcloud share onto media or shared for physical handling, server-side encryption protects file contents at rest on local and external storage. The keys are kept on the server. The important limit is that Nextcloud does not encrypt file names or folder structure, so the names of CUI documents and their hierarchy can still be read by anyone with access to the storage. Teams should plan for this when file names themselves are sensitive.
- Content protection: File contents are encrypted on the storage backend, which supports confidentiality of data at rest.
- Name exposure: File names and folder structure stay visible, so naming conventions should avoid revealing CUI content.
- Key location: Because keys sit on the server, the server's own protection and administration controls carry significant weight.
- Evidence: Encryption configuration settings and their dated screenshots or exports can support the assessment file.
Verify the encryption configuration against the Nextcloud admin manual for your version, and confirm how encryption applies to any external storage mounts you use.
OpenBao's transit secrets engine encrypts and decrypts application data without storing that data, signs and verifies data, and supports versioned encryption keys with key rotation. It is a key management option for applications that need to protect CUI before it is written to media or sent elsewhere. It does not handle the media itself, and it is not a substitute for encrypting the media or a transport record. Its role in this topic is narrow: it can hold and rotate the keys that protect data that will later move on media.
- Application encryption: Applications can send data to the engine for encryption, so keys stay outside the application.
- Key rotation: Versioned keys let the organization rotate keys and show when rotation occurred.
- Signing: Signature verification can support the integrity of files prepared for transport.
- Scope limit: OpenBao does not track custody, packaging or delivery of media.
Use OpenBao as one option among the key management approaches in your environment, and confirm with your security team how keys for media encryption will be issued, stored and retired. OpenBao is licensed under MPL-2.0.
What meeting 03.08.05 costs in money and effort
Meeting 03.08.05 costs money and staff time in four places: people writing and running the transport procedures and log, encryption tools and approved secure containers for media that leave controlled areas, carrier or courier fees where a third party moves media, and training for the people who sign media out and hand it over. A fifth cost, assessor time, is paid to an independent assessor and rises with how much sampling they need to see. No price is given here. Ask each vendor and courier for written rates, and ask your assessor how they plan to sample transport records, because that determines how much evidence you must have ready.
Most of the cost is one-time work. Your team must inventory the media types that carry CUI, decide which transports are allowed and under what conditions, write the transport procedure, set up the custody log, and configure encryption for portable media and backups. Procurement of secure containers and any encryption tooling also falls here. Recurring work includes keeping the transport log complete, refreshing training when procedures change, reviewing a sample of logged transports, and rechecking the inventory when new media types appear. Ask a quote to separate these two groups so you can see what continues after the first assessment.
Four drivers move the total most: the number of media types in scope, the volume of transports per month, the distance and handling chain from origin to destination, and whether you use your own staff, an approved courier or a carrier that hands media across several parties. Each added hop adds custody records and a party whose handling you must describe. A written scope should state the media types, expected transport volume, routes, carrier model and the boundary of the controlled area, so that any quote prices the same work you intend to do.
Who owns 03.08.05, who can help, and where the assessor stops
The organization owns requirement 03.08.05 in full. Transport decisions, the people who authorize movement of media containing CUI, and the records that show what happened in transit all sit with your team. A partner can help build these, but cannot make the decisions or stand behind them when the contracting agency asks questions.
- Transport decisions: Decide which media may leave controlled areas, who approves each movement, and which protections (encryption, tamper-evident packaging, courier type) apply.
- Procedure ownership: Approve and maintain the media transport procedure, and keep it aligned with the system security plan and media protection policy.
- Accountability in transit: Assign named custodians for each transport and define how custody passes between people or sites.
- Logs and records: Keep the transport records that document activity, and review them on a defined schedule.
- Agency relationship: Answer to the agency that holds the contract, which NIST's FAQ identifies as responsible for application and compliance issues.
Before relying on any transport process, confirm with your contracting officer which records they expect to see.
An implementation partner such as DeployOpen works inside your environment and under a written scope to prepare systems, documentation and evidence for 03.08.05. The partner does not own the transport decisions and does not certify that the controls work. Its value lies in building the technical and documentary groundwork so your team can show the requirement is met.
- Media inventory: Help build and maintain an inventory of system media that contain CUI, so transport scope is clear.
- Encryption and logging tooling: Configure encryption and logging components, such as the encryption and key handling used for CUI at rest, and the inventory or audit tooling that records asset movement.
- Draft procedures and templates: Draft the media transport procedure and log templates for your review and approval.
- Evidence preparation: Collect configuration exports, log samples and records that map to the examine, interview and test objects in the assessment procedure.
- Handover: Document how your staff operate and review the tooling after the engagement ends.
Ask any partner to state in the written scope which artifacts it will deliver and which decisions remain with your staff.
Only an independent assessor, auditor or certification body issues assessment results. For DoD work, the assessment mechanisms are defined by the CMMC program and the DFARS clause in use at the time. The assessor examines your documents, interviews your personnel and tests your mechanisms, then forms its own judgment. Preparing evidence for an assessor does not count as an assessment.
- What the assessor checks: Four determination statements for 03.08.05, tested through examine, interview and test methods.
- What the assessor does not do: It does not write your procedures, configure your tools or decide your transport risk tolerance.
- Who pays and who hires: Confirm with the agency and the program which assessor is acceptable and how the engagement is contracted.
- Timing of evidence: Ask the assessor whether it wants records from a defined period, and confirm that your logs cover that period.
- Outcome: Only the assessor's report or certification counts toward the requirement, so treat partner preparation as input, not as a result.
Before engaging anyone, confirm the assessor's accreditation and the current program rules with the contracting agency.
Where media transport controls usually fail review
Assessors testing 03.08.05 look for proof that CUI media moved under control, with an accountable owner at every step. The gaps below are the ones that most often turn a documented procedure into a finding, and each one has a concrete check you can run before an assessment.
Transport happens without a log entry
Media leaves a controlled area in a bag, a truck or a colleague's car, and nothing records it. The requirement expects you to document the activities associated with transport, so an assessor will ask for a transport record for a sample of moves and compare it with what actually happened. Check whether your records capture the item, the sender, the recipient, the departure and arrival times, and the method of transport. Pick three recent movements at random and trace each one back to a log entry. If you cannot find one for each, the gap is in the process, not the paperwork.
Procedure exists but staff do not follow it
A transport procedure in the policy library does not show that people use it. Assessors commonly interview staff who move media and ask them to describe the steps, then compare their answers with the written procedure. Gaps appear when staff rely on habit, when shared drives are used to hand off files, or when exceptions are granted informally. Ask a sample of staff to walk you through their last transport task and note every point where they departed from the written steps. Each difference is either a training issue or a procedure that needs to be rewritten to match how work is actually done.
Couriers are not approved or trained
When an outside courier or a shipping service carries CUI media, the organization still owns the accountability requirement. Assessors look for a list of approved carriers, evidence that couriers were vetted, and proof that those handling CUI were briefed on handling and custody rules. Many organizations use a general courier contract with no CUI terms, which leaves no clear answer to who signed for a package or what happened if it went missing. Confirm the approved carrier list, the contract terms that cover custody and incident notice, and the briefing record for each courier role.
Encryption is assumed, not verified
Teams often state that portable media is encrypted without checking the encryption status of each device. The requirement sits alongside 03.13.08 and 03.13.11, which cover transmission confidentiality and cryptographic protection, so an assessor will expect evidence that the protection is in place for the specific device in transit. Verify encryption on each portable device through the management tool or a documented check, and confirm that the cryptographic modules used are the ones your system security plan names. Keep the check result with the transport record so the claim can be tested later.
Inventory does not match what moves
The media inventory lists the drives, tapes and disks the organization believes it has, but transport records show different items moving, or items moving that appear nowhere on the list. An assessor will compare the two, and any mismatch undermines the accountability claim for the whole transport process. Reconcile the inventory against transport logs and asset records at regular intervals, and investigate any item that has no owner, location or recorded movement. Asset management tools can help keep the inventory current, but the reconciliation itself must be performed and recorded by the organization.
Questions buyers ask about media transport before hiring help
Can a partner write our media transport procedure for us?
Yes, a partner can draft the transport procedure, but your organization owns it and must approve it. The procedure needs to name the media covered, who may authorize a transfer, how packages are sealed and handed over, which couriers or carriers are approved, and what records are kept at each step. DeployOpen prepares these documents as part of an implementation scope agreed in writing. Your staff still have to run the process day to day, and an assessor will check whether people actually follow the written procedure, so expect to review the draft against how your team really moves media. Confirm during scoping who signs off on the final version and who maintains it after the engagement ends.
How much effort does the transport log add to daily work?
The effort depends on how often media leaves controlled areas and how many people handle it. The requirement asks you to document transport activity and keep accountability for media while it is in transit, so each movement needs a record: what the media is, who released it, who carried it, the destination, and who received it. For a small team that moves media rarely, a simple form or ticket may be enough. For a team that moves media often, the log is better handled through a system that records entries automatically and links them to asset records. Ask any partner to show you the fields they propose and estimate the volume with your own staff before agreeing on scope.
Does encrypting the media satisfy the transport requirement on its own?
No, encryption helps but does not replace the other parts of the requirement. The requirement covers three things: protecting and controlling media during transport outside controlled areas, keeping accountability for it in transit, and documenting the transport. Encryption addresses confidentiality if media is lost, while the cryptographic requirements in 03.13.08 and 03.13.11 cover transmission and key handling. Assessors will still expect a documented chain of custody and a record of each transfer. Treat encryption as one control within a transport process, not as the process. Confirm with your assessor how they expect encryption and custody records to fit together for your media types.
What does the work need from our internal staff?
Expect to provide time from people who own the media, the physical handling process, and the systems that record it. Typically this includes a security or compliance lead who can make policy decisions, operations staff who handle media and courier arrangements, and an administrator who can connect asset and inventory data to the transport records. Interviews are part of how assessors test this requirement, so the people who move media must be able to describe what they do. Ask the partner for a list of roles and sessions before work starts, and confirm who will be available during each phase.
How long does setting up media transport controls take?
The timeline depends on the agreed scope. A scope that covers only a written procedure and a log template will take far less time than one that includes new asset inventory, encryption tooling, courier contracts, and staff training. Most engagements are fixed-scope, so the deliverables and schedule are agreed in writing before work starts. Ask for a schedule that lists each deliverable, the staff time it needs, and the dependencies on your procurement or third parties. DeployOpen does not publish fixed durations, so the schedule should come from the written scope rather than a general estimate.
Does DeployOpen issue the assessment result for media transport?
No. DeployOpen prepares systems, procedures and evidence for the transport requirement, but it does not issue audit reports, attestations or certifications. Your contract may require an assessment by a government body, an independent assessor, or your contracting agency, depending on the framework that applies to you. Only that independent party can issue the result. Before engaging anyone, confirm with your contracting officer or assessor which assessment applies and what evidence they will request for 03.08.05.
How DeployOpen prepares media transport evidence
DeployOpen plans, implements and documents the systems and records an organization needs to show that CUI on media is controlled while it moves outside controlled areas. The organization keeps ownership of its controls and its assessment decisions, and an independent assessor makes the final call on whether 03.08.05 is met.
How we scope
- Agree in writing which media types, transport paths and handling roles fall under 03.08.05 for your system.
- Confirm which systems hold the transport logs, custody records and encryption settings the assessment will examine.
- Name the policies and procedures assessors will ask for, such as media protection and physical protection procedures.
How we build
- Configure self-hosted systems to record media and asset movements, such as GLPI Assets entries for transported devices.
- Set up encryption and key handling for CUI in backups and file stores, aligned with the related 03.13 requirements.
- Deploy inventory collection, for example Wazuh Syscollector, so asset records match what is actually in the environment.
How we hand over
- Deliver a written mapping of each 03.08.05 determination statement to the policy, record or system that answers it.
- Provide sample transport records, custody templates and review procedures that your staff can run without us.
- Document the configuration, owners and open items so your assessor can examine evidence without guesswork.
How we support
- Offer ongoing support and upgrades as a retainer when your transport practices or systems change after handover.
- Repeat evidence checks after changes to tooling, encryption keys or transport procedures, and record the results.
- Confirm with your assessor and contracting officer which 03.08.05 evidence they expect for your specific contract.
