Media Protection
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.
The 9 Media Protection requirements
15 assessment objectives across this family.
- 3.8.1Media ProtectionProtect (i.e., physically control and securely store) system media containing CUI, both paper and digital.3 pt✕ POA&M
- 3.8.2Media AccessLimit access to CUI on system media to authorized users.3 pt✕ POA&M
- 3.8.3Media DisposalSanitize or destroy system media containing CUI before disposal or release for reuse.5 pt✕ POA&M
- 3.8.4Media MarkingsMark media with necessary CUI markings and distribution limitations.1 pt
- 3.8.5Media AccountabilityControl access to media containing CUI and maintain accountability for media during transport outside of controlled areas.1 pt
- 3.8.6Portable Storage EncryptionImplement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.1 pt
- 3.8.7Removeable MediaControl the use of removable media on system components.5 pt✕ POA&M
- 3.8.8Shared MediaProhibit the use of portable storage devices when such devices have no identifiable owner.3 pt✕ POA&M
- 3.8.9Protect BackupsProtect the confidentiality of backup CUI at storage locations.1 pt
Build Media Protection, and all 14 families, with an officer
The Level 2 workspace walks all 110 requirements with you at the objective level, generates your SSP, POA&M, and Audit Room from real evidence, gives your assessor a read only seat, and puts a Registered Practitioner alongside you year round.
No credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessment and self attestation are law today, DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged, so the Level 2 work counts either way.
Questions, answered
How many CMMC Level 2 requirements are in Media Protection?+
The Media Protection family (MP) has 9 of the 110 CMMC Level 2 requirements, assessed against 15 objectives from NIST SP 800-171A.
What is the Media Protection family about?+
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.