Media Protection
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.
The 9 Media Protection requirements
15 assessment objectives across this family.
- 3.8.1Media ProtectionProtect (i.e., physically control and securely store) system media containing CUI, both paper and digital.3 pt✕ POA&M
- 3.8.2Media AccessLimit access to CUI on system media to authorized users.3 pt✕ POA&M
- 3.8.3Media DisposalSanitize or destroy system media containing CUI before disposal or release for reuse.5 pt✕ POA&M
- 3.8.4Media MarkingsMark media with necessary CUI markings and distribution limitations.1 pt
- 3.8.5Media AccountabilityControl access to media containing CUI and maintain accountability for media during transport outside of controlled areas.1 pt
- 3.8.6Portable Storage EncryptionImplement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.1 pt
- 3.8.7Removeable MediaControl the use of removable media on system components.5 pt✕ POA&M
- 3.8.8Shared MediaProhibit the use of portable storage devices when such devices have no identifiable owner.3 pt✕ POA&M
- 3.8.9Protect BackupsProtect the confidentiality of backup CUI at storage locations.1 pt
Build Media Protection, and all 14 families, with an officer
The Level 2 Accelerator walks all 110 requirements with you, generates your SSP, POA&M, and Audit Room from real evidence, includes the full Level 1 platform, and puts a credentialed officer alongside you for 180 days. Filed in 180 days, or we work free until you are.
No credit card. Phase 2 begins Nov 10, 2026, when applicable DoD solicitations start requiring a current Level 2 status to win the award.
Questions, answered
How many CMMC Level 2 requirements are in Media Protection?+
The Media Protection family (MP) has 9 of the 110 CMMC Level 2 requirements, assessed against 15 objectives from NIST SP 800-171A.
What is the Media Protection family about?+
Media Protection is about controlling the physical and digital media that carry CUI: drives, backups, paper, and how they are stored, transported, and destroyed. CUI does not stop being CUI when it leaves the screen.