Media Protection
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.
The 9 Media Protection requirements
15 assessment objectives across this family.
- 3.8.1Media ProtectionProtect (i.e., physically control and securely store) system media containing CUI, both paper and digital.3 pt✕ POA&M
- 3.8.2Media AccessLimit access to CUI on system media to authorized users.3 pt✕ POA&M
- 3.8.3Media DisposalSanitize or destroy system media containing CUI before disposal or release for reuse.5 pt✕ POA&M
- 3.8.4Media MarkingsMark media with necessary CUI markings and distribution limitations.1 pt
- 3.8.5Media AccountabilityControl access to media containing CUI and maintain accountability for media during transport outside of controlled areas.1 pt
- 3.8.6Portable Storage EncryptionImplement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.1 pt
- 3.8.7Removeable MediaControl the use of removable media on system components.5 pt✕ POA&M
- 3.8.8Shared MediaProhibit the use of portable storage devices when such devices have no identifiable owner.3 pt✕ POA&M
- 3.8.9Protect BackupsProtect the confidentiality of backup CUI at storage locations.1 pt
Build Media Protection, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Media Protection?+
The Media Protection family (MP) has 9 of the 110 CMMC Level 2 requirements, assessed against 15 objectives from NIST SP 800-171A.
What is the Media Protection family about?+
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.