CMMC Practice MP.2.119: Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
CMMC CLARIFICATION (Ref CMMC – Appendix B)
Physical CUI includes two types of items:
- hardcopy (e.g., paper, microfilm); and
- digital devices (e.g., CD drives, flash drives, video).
You should store physical CUI in a secure location. This location should be accessible only to those people with the proper permissions. All who access CUI should follow the process for checking out and returning it.