MP.2.119 Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

CMMC Practice MP.2.119: Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

Links to Publicly Available Resources

CMMC CLARIFICATION (Ref CMMC – Appendix B)

Physical CUI includes two types of items:

  • hardcopy (e.g., paper, microfilm); and
  • digital devices (e.g., CD drives, flash drives, video).

You should store physical CUI in a secure location. This location should be accessible only to those people with the proper permissions. All who access CUI should follow the process for checking out and returning it.