---
title: "NIST 800-171 3.8 Media Protection"
description: "The 9 NIST SP 800-171 Media Protection requirements (3.8, CMMC MP): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/media-protection
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/media-protection
records: 4
digest: sha3:901a01f870770cb0e4037293aa8fda7edae44d67df03dfa2a8a056d77c9d99f4
---

# NIST 800-171 3.8 Media Protection

NIST 800-171 / Media Protection

Media Protection governs CUI on paper and on portable digital media such as USB drives, external disks and backup tapes: storage, access, marking, transport, encryption, disposal and backups.

9 requirements · up to 23 SPRS points · 4 can go on a CMMC POA&M

## The 9 Media Protection requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.8.1 Media Protection](https://policycortex.com/nist-800-171/media-protection/3.8.1) | MP.L2-3.8.1 | 3 points | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. |
| [3.8.2 Media Access](https://policycortex.com/nist-800-171/media-protection/3.8.2) | MP.L2-3.8.2 | 3 points | Limit access to CUI on system media to authorized users. |
| [3.8.3 Media Sanitization](https://policycortex.com/nist-800-171/media-protection/3.8.3) | MP.L2-3.8.3 | 5 points | Sanitize or destroy system media containing CUI before disposal or release for reuse. |
| [3.8.4 Media Marking](https://policycortex.com/nist-800-171/media-protection/3.8.4) | MP.L2-3.8.4 | 1 point | Mark media with necessary CUI markings and distribution limitations. |
| [3.8.5 Media Transport](https://policycortex.com/nist-800-171/media-protection/3.8.5) | MP.L2-3.8.5 | 1 point | Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. |
| [3.8.6 Encrypt Media in Transit](https://policycortex.com/nist-800-171/media-protection/3.8.6) | MP.L2-3.8.6 | 1 point | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. |
| [3.8.7 Removable Media](https://policycortex.com/nist-800-171/media-protection/3.8.7) | MP.L2-3.8.7 | 5 points | Control the use of removable media on system components. |
| [3.8.8 Ownerless Storage](https://policycortex.com/nist-800-171/media-protection/3.8.8) | MP.L2-3.8.8 | 3 points | Prohibit the use of portable storage devices when such devices have no identifiable owner. |
| [3.8.9 Backup Confidentiality](https://policycortex.com/nist-800-171/media-protection/3.8.9) | MP.L2-3.8.9 | 1 point | Protect the confidentiality of backup CUI at storage locations. |

## Media Protection: points and the CMMC POA&M

**Q: How many SPRS points can the Media Protection family cost?**
A: Up to 23 of the 313 points a score can lose: 2 worth 5 points, 3 worth 3 and 4 worth 1.

**Q: Which Media Protection requirements can go on a CMMC POA&M?**
A: 4 of the 9: 3.8.4, 3.8.5, 3.8.6 and 3.8.9, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Media Protection requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-MP)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.7 Maintenance](https://policycortex.com/nist-800-171/maintenance)
- **Next family**: [3.9 Personnel Security](https://policycortex.com/nist-800-171/personnel-security)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | 72baecf9ca54 | 74e3fcc46706 |
| REC 0001 | REQUIREMENTS | 8b660ac69801 | 72baecf9ca54 |
| REC 0002 | POINTS AND POA&M | 1945cd51094d | 8b660ac69801 |
| REC 0003 | RELATED | 901a01f87077 | 1945cd51094d |

Head sha3:901a01f870770cb0e4037293aa8fda7edae44d67df03dfa2a8a056d77c9d99f4. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.