CMMC MP.L2-3.8.4: Media Markings & CUI Distribution Controls
Media markings are your organization's first line of defense against unauthorized CUI distribution. This CMMC Level 2 control requires you to clearly mark all media containing Controlled Unclassified Information with appropriate CUI designations and handling restrictions. Proper marking ensures employees understand data sensitivity and handle materials accordingly.
What this means
MP.L2-3.8.4 mandates that all media containing CUI must be visibly marked with CUI indicators and any applicable distribution limitations. This applies to physical media (hard drives, USB devices, printed documents) and logical media (file systems, databases). Markings must be clear enough that anyone handling the media understands its classification status and any restrictions on sharing or disclosure. The control prevents accidental exposure by making sensitivity levels obvious before data is moved, shared, or disposed of.
How to comply
- 1.Establish a media marking policy defining CUI indicators ("CUI" designation, portion marking format, and banner statements for documents)
- 2.Create marking standards for both physical media (labels, stamps) and digital media (file metadata, headers, system classifications)
- 3.Implement a classification process to identify which media contains CUI before it leaves your facility or reaches storage
- 4.Apply consistent markings at creation or receipt of CUI media, using standardized templates and formats across teams
- 5.Document all media marking procedures in your security program documentation
- 6.Train employees on recognizing CUI markings and understanding corresponding handling restrictions
- 7.Conduct periodic audits to verify all CUI media is properly marked before distribution or archival
- 8.Establish secure disposal procedures for marked media to prevent unauthorized recovery
Evidence auditors look for
- Media marking policy document showing CUI marking requirements and distribution limitations
- Labeled physical media samples (USB drives, hard drives, external storage with CUI designations)
- Digital media examples showing CUI headers, banners, or metadata classification tags
- Document templates with pre-populated CUI markings and distribution statements
- Employee training records confirming staff understand media marking standards
- Audit logs or checklists verifying periodic media marking compliance reviews
- Media inventory records showing classification status and marking dates
- Secure disposal procedures referencing CUI-marked media handling
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
See how GRCWatch handles this control automatically.
See how GRCWatch handles this control automatically
Start free trial