03.08: Media Protection

Physically control and securely store system media that contain CUI.

Restrict access to CUI on system media to authorized personnel or roles.

Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.

Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings.

Protect and control system media that contain CUI during transport outside of controlled areas. Maintain accountability of system media that contain CUI during transport outside of controlled areas. Document activities associated with the transport of system media that contain CUI.

Restrict or prohibit the use of [Assignment: organization-defined types of system media]. Prohibit the use of removable system media without an identifiable owner.

Protect the confidentiality of backup information. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations.