CMMC Practice MP.L2-3.8.4 – Media Markings: Mark media with necessary CUI markings and distribution limitations.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. The Principle of Least Privilege (POLP) is widely considered to be one of the most effective practices for strengthening an organization’s cybersecurity posture, in that it allows organizations to control and monitor network and data access. By applying the principle of least privilege, organizations can limit the reach of user access into their network, information systems and media access. The DCSA CUI Program Office is dedicated to providing up-to-date information, tools, and resources to support Industry's implementation of CUI programs. This Defense Counterintelligence and Security Agency (DCSA) Controlled Unclassified Information (CUI) webpage is routinely updated with news and information related to DCSA’s CUI oversight responsibilities. In accordance with the authority in DoD Directive (DoDD) 5143.01 and the December 22, 2010 Deputy Secretary of Defense Memorandum, this issuance: •Establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DoD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012. •Establishes the official DoD CUI Registry. This handbook provides examples of correctly marking Controlled Unclassified Information (CUI). This link from the National Archives provides additional resources to assist with marking CUI. This link from the National Archives provides training videos for marking CUI. This blog provides examples of correctly marking Controlled Unclassified Information (CUI) and forms for purchase. This article breaks down CMMC Section 3.8, which focuses on the media protection for media that contains controlled unclassified information (CUI) This GSA-IT Security MP Procedurals reference provides guidance for the MP security controls identified in NIST SP 800-53 and federal contractor media protection requirements.
Discussion [NIST SP 800-171 R2]
The term security marking refers to the application or use of human-readable security attributes. System media includes digital and non-digital media. Marking of system media reflects applicable federal laws, Executive Orders, directives, policies, and regulations.
Further Discussion
All media, hardcopy and digital, must be properly marked to alert individuals to the presence of CUI stored on the media. The National Archives and Records Administration (NARA) has published guidelines for labeling media of different sizes.
MP.L2-3.8.8 requires that media have an identifiable owner, so organizations may find it desirable to include ownership information on the device label as well.