NIST 800-171 3.8 Media Protection
Media Protection governs CUI on paper and on portable digital media such as USB drives, external disks and backup tapes: storage, access, marking, transport, encryption, disposal and backups.
9 requirementsup to 23 SPRS points4 can go on a CMMC POA&M
The 9 Media Protection requirements
- 3.8.1 Media ProtectionMP.L2-3.8.1Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- 3.8.2 Media AccessMP.L2-3.8.2Limit access to CUI on system media to authorized users.
- 3.8.3 Media SanitizationMP.L2-3.8.3Sanitize or destroy system media containing CUI before disposal or release for reuse.
- 3.8.4 Media MarkingMP.L2-3.8.4Mark media with necessary CUI markings and distribution limitations.
- 3.8.5 Media TransportMP.L2-3.8.5Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
- 3.8.6 Encrypt Media in TransitMP.L2-3.8.6Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
- 3.8.7 Removable MediaMP.L2-3.8.7Control the use of removable media on system components.
- 3.8.8 Ownerless StorageMP.L2-3.8.8Prohibit the use of portable storage devices when such devices have no identifiable owner.
- 3.8.9 Backup ConfidentialityMP.L2-3.8.9Protect the confidentiality of backup CUI at storage locations.
Media Protection: points and the CMMC POA&M
- Q-01
How many SPRS points can the Media Protection family cost?
Up to 23 of the 313 points a score can lose: 2 worth 5 points, 3 worth 3 and 4 worth 1.
- Q-02
Which Media Protection requirements can go on a CMMC POA&M?
4 of the 9: 3.8.4, 3.8.5, 3.8.6 and 3.8.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication