Requirements 3.8
3.8 Media Protection: the NIST SP 800-171 requirements
The 9 requirements of family 3.8, Media Protection, in NIST SP 800-171 Rev 2, worth 23 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.8.1 Media Protection
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]paper media containing CUI is physically controlled.
- [b]digital media containing CUI is physically controlled.
- [c]paper media containing CUI is securely stored.
- [d]digital media containing CUI is securely stored.
How to meet it
Store CUI media (paper files, USB drives, backup drives, DVDs) in locked cabinets or rooms with access limited to authorized staff, and define the storage locations in a media handling policy. Buying a locking cabinet and consolidating loose media into it is a same-week fix. Evidence: the policy, photos of the secured storage, and the key/combination holder list.
3.8.2 Media Access Control
Limit access to CUI on system media to authorized users.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]access to CUI on system media is limited to authorized users.
How to meet it
Limit who can access stored CUI media: keep a named list of authorized personnel, control keys or badge access to the storage location, and use a check-out log for removable media so accountability is maintained. Evidence: the authorized personnel list, access control records for the storage area, and the media check-out log.
3.8.3 Media Sanitization
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]system media containing CUI is sanitized or destroyed before disposal.
- [b]system media containing CUI is sanitized before it is released for reuse.
How to meet it
Sanitize media per NIST SP 800-88 before disposal or reuse: cryptographic erase or multi-pass wipe for drives (tools like Blancco or built-in secure erase), physical destruction for failed drives and optical media, and cross-cut shredding for paper CUI. Keep a destruction log or vendor certificates of destruction. Evidence: the sanitization procedure, destruction certificates, and the disposal log.
3.8.4 Media Marking
Mark media with necessary CUI markings and distribution limitations.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]media containing CUI is marked with applicable CUI markings.
- [b]media containing CUI is marked with distribution limitations.
How to meet it
Label media containing CUI with appropriate CUI markings per the CUI Registry (a "CUI" label with category where applicable), including external drives, backup tapes, and file folders. Pre-printed labels and a one-page marking guide for staff make this fast to operationalize. Evidence: the marking procedure and photos of labeled media.
3.8.5 Media Accountability
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]access to media containing CUI is controlled.
- [b]accountability for media containing CUI is maintained during transport outside of controlled areas.
How to meet it
Control media leaving your facility: require sign-out with name, date, destination, and return date, restrict transport to accountable personnel or tracked couriers, and prohibit unlogged removal in policy. Evidence: the transport log with completed entries and the policy language restricting media movement.
3.8.6 Portable Storage Encryption
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
How to meet it
Encrypt CUI on any media transported outside controlled areas: issue hardware-encrypted USB drives (FIPS 140-validated models such as Apricorn or Kingston IronKey) as the only approved portable media, and enable BitLocker To Go enforcement so unencrypted drives are read-only or blocked. Evidence: the encrypted-drive inventory, endpoint policy enforcing removable media encryption, and the FIPS certificates of the chosen drives.
3.8.7 Removable Media Control
Control the use of removable media on system components.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]the use of removable media on system components is controlled.
How to meet it
Define which removable media types are allowed and block the rest through endpoint device control (Intune, Defender for Endpoint, or EDR policies can block USB storage by default and allowlist approved encrypted drives). Prohibiting personal USB drives entirely is the cleanest small-business posture. Evidence: the removable media policy and the device control configuration with block events.
3.8.8 Shared Resource Control
Prohibit the use of portable storage devices when such devices have no identifiable owner.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]the use of portable storage devices is prohibited when such devices have no identifiable owner.
How to meet it
Block media with no identifiable owner: configure device control to allow only serialized, organization-issued drives, and instruct staff (via policy and training) never to plug in found or unlabeled USB devices. This pairs naturally with the 3.8.7 allowlist. Evidence: the policy statement, training content covering found media, and the device allowlist keyed to specific hardware IDs.
3.8.9 Backup CUI Protection
Protect the confidentiality of backup CUI at storage locations.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]the confidentiality of backup CUI is protected at storage locations.
How to meet it
Encrypt backups containing CUI both in transit and at rest: enable encryption in your backup product (Veeam, Datto, cloud backup) with FIPS-validated crypto where available, protect the backup repository's access with MFA, and verify offsite/cloud copies are encrypted too. Confirm with a restore test that keys are recoverable. Evidence: backup encryption settings, key management documentation, and a successful test restore record.