3.8.2

Requirement

Restrict access to CUI on system media to authorized personnel or roles.

Discussion

System media include digital and non-digital media. Access to CUI on system media can be restricted by physically controlling such media. This includes conducting inventories, ensuring that procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for stored media. For digital media, access to CUI can be restricted by using cryptographic means. Encrypting data in storage or at rest is addressed in 03.13.08.

NIST 800-171A r3 Assessment Guidance

Examine

[SELECT FROM: physical protection policy and procedures; media protection policy and procedures; procedures for media access restrictions; access control policy and procedures; media storage facilities; access control records; system security plan; other relevant documents or records]
Interview

[SELECT FROM: processes for restricting information on media; mechanisms for supporting or implementing media access restrictions]
Test

[SELECT FROM: personnel with system media protection responsibilities; personnel with information security responsibilities; system administrators]

ID	Assessment Objectives
A.03.08.02	access to CUI on system media is restricted to authorized personnel or roles.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!