Protect the copies, from the printer tray to the backup shelf.
Work through all nine requirements and 15 assessment objectives. Control paper and digital media, limit access, mark and transport it correctly, and check disposal, reuse, removable devices and backup storage. Start with your current equipment and approved handling procedures.
Sources reviewed October 28, 2026. These instructions have not been tested in a Microsoft tenant. This guide does not establish compliance or replace an official assessment. Suggested checks and manual worksheet states are working aids.
Find the CUI copies. Include paper, portable storage, equipment storage, backups and provider-held copies. Use Do we handle CUI? when the information status needs clarification.
Identify the owner and authorized users. Decide who may handle, access and approve use of each media type. Ownership, authorized access and encryption answer different questions.
Check storage, markings and movement. Review physical control, secure storage, applicable markings, transport safeguards and accountable handoffs. Include the paper leaving a printer.
Control use and release. Prohibit unowned portable storage, check permitted removable-media use, and verify sanitization or destruction before the relevant disposal or reuse release.
Keep actual results. Record observations, restricted evidence references and open actions. A plan, encryption screen or completed worksheet does not establish every objective.
Use fictional records and harmless files for the exercises. Do not erase real media, connect unknown drives or change production restrictions as an exercise. Keep CUI, recovery keys, passwords, detailed system records and evidence in your approved environment. This website does not receive completed worksheets or exercise answers.
Control and securely store paper and digital media
Find the copies that can leave a protected screen. Paper files, printed drawings, USB drives, disks and storage inside printers can hold CUI. Account for physical control and secure storage for both paper and digital media.
Official requirement and assessment objectives
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.1
Objective
Official text
3.8.1[a]
paper media containing CUI is physically controlled.
3.8.1[b]
digital media containing CUI is physically controlled.
3.8.1[c]
paper media containing CUI is securely stored.
3.8.1[d]
digital media containing CUI is securely stored.
What to do
Identify the media and its custodian
Use your CUI and asset records to identify paper and digital media, including portable storage, printer/copier storage and offline copies. Record responsible roles and approved locations using restricted references. Do not copy CUI into a public worksheet or this website.
Control media while it is in use
Define who may handle it and where. Use appropriate physical controls for the work area, printing, checkout and return. Prevent unattended paper, drives or other media being accessible to unauthorized people. A sign on a cabinet does not show who can open it.
Check storage separately
Check how paper and digital media are secured when not in use, including keys, access lists, containers and provider responsibilities. Sample actual locations and handling records. Record missing coverage separately for paper control, digital control, paper storage and digital storage.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.1[a]
Observe how paper containing CUI is physically controlled during printing, use and return.
Records to keep: Approved handling rules, responsible roles and an actual observation or handling reference for paper.
3.8.1[b]
Observe how digital media containing CUI is physically controlled, including portable and equipment storage in scope.
Records to keep: Media inventory, custody/access arrangements and actual digital-media handling checks.
3.8.1[c]
Check the actual secure storage used for paper containing CUI.
Records to keep: Restricted location reference, authorized access and observed storage safeguards.
3.8.1[d]
Check the actual secure storage used for digital media containing CUI.
Records to keep: Media/location references, physical safeguards and customer/provider responsibility evidence.
Records to keep
Paper and digital media categories, responsible custodians and approved storage references.
Actual handling and storage checks, access arrangements and unresolved findings.
If a check fails
If media is missing or accessible to unauthorized people, protect what remains and use the incident procedure where exposure is suspected. Establish a controlled location and responsible custodian before normal handling resumes.
Working with a small budget
Start with an Office register and the controlled storage you already have. Cabinets, locks, secure print arrangements and off-site storage may still cost money. Encryption does not replace the physical checks.
Permission to hold a device is not automatically permission to read its contents. Check who can access the CUI on each type of media, including shared or recovered copies.
Official requirement and assessment objectives
Limit access to CUI on system media to authorized users
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.2
Objective
Official text
3.8.2
Determine if access to CUI on system media is limited to authorized users.
What to do
Identify authorized users
Use actual business need, contract restrictions and approved access decisions. Include printed files, removable storage, media libraries and provider access. A device owner or vendor name alone does not authorize every user.
Apply access controls to each copy
Control physical access, checkout, digital permissions and decryption/key access as applicable. SharePoint permissions do not protect a printed copy or an exported file. File permissions alone do not protect an unencrypted disk that can be read outside the intended Windows system.
Check permitted and denied access safely
Use an approved test account and harmless sample files in a suitable environment. Confirm authorized access and denial for someone outside the approved group. Keep real CUI, passwords and recovery keys out of screenshots and worksheets.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.2
Compare the approved CUI users with actual physical and digital access to sampled media, including relevant key access.
Records to keep: Access decision, user/group and custody references, permissions and authorized safe access-check results.
Records to keep
Approved users and access decisions for each media category.
Actual access checks and changes when responsibilities or employment change.
If a check fails
Remove unauthorized access using the approved procedure and investigate possible disclosure. Avoid locking out the recovery owner: coordinate key and access changes, then recheck permitted and denied access.
Working with a small budget
Existing access groups, controlled keys and physical custody can be useful starting points. Office stores the register; it does not enforce access. Specialist access or key-management features may require licensing.
Decide what must happen before a drive, paper file or other medium leaves its current use. Disposal and reuse are separate decisions, and an approved request is not proof that sanitization occurred.
Official requirement and assessment objectives
Sanitize or destroy system media containing CUI before disposal or release for reuse.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.3
Objective
Official text
3.8.3[a]
system media containing CUI is sanitized or destroyed before disposal.
3.8.3[b]
system media containing CUI is sanitized before it is released for reuse.
What to do
Identify the medium and any hold
Include paper and digital media, equipment storage, hidden or reserved storage where relevant, and provider-held copies. Check retention, incident/evidence holds and recovery needs before any authorized action. Do not erase a device as a training exercise.
Select an appropriate approved method
Use current NIST sanitization guidance, applicable agency rules and supported vendor instructions for the actual medium. For disposal, sanitize or destroy as appropriate; for reuse, verify sanitization before release. File deletion and quick formatting are not sufficient evidence. Cryptographic erase requires an appropriate implementation, relevant key handling and assurance; an encrypted status screen alone does not establish it.
Verify the result and release decision
Record the actual media identifier, method, operator, date, execution outcome, verification/validation and authorized release. A generic destruction certificate without a reliable link to the actual media leaves a gap. If damaged media cannot be sanitized or the result cannot be verified, retain control and arrange an approved alternative.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.3[a]
Trace sampled disposed media to actual sanitization or destruction before disposal, including failed or damaged media.
Records to keep: Media reference, selected method, execution and verification/validation, custody and disposal approval.
3.8.3[b]
Trace sampled media released for reuse to verified sanitization before that release.
Records to keep: Reuse decision, media reference, actual sanitization/assurance record and release approval.
Records to keep
Media-specific sanitization/destruction methods and authority, holds and recovery decisions.
Execution, verification/validation, custody, release and failed-action records linked to the actual media.
If a check fails
Block release if sanitization fails, a hold applies or verification is missing. Keep the medium controlled and obtain an approved alternative or qualified assistance. A gap note is not permission to hand over unsanitized media.
Working with a small budget
Use suitable supported vendor processes and your existing records where they meet the need. Some media needs specialist destruction, retained-drive arrangements or replacement. A free wiping utility is not suitable for every SSD, failed device or paper record.
Apply the required markings and distribution limits
Help people recognize CUI and its handling restrictions on paper and digital media. Use the applicable agency marking guidance rather than guessing from a filename, a commercial sensitivity label or the word confidential.
Official requirement and assessment objectives
Mark media with necessary CUI markings and distribution limitations.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.4
Objective
Official text
3.8.4[a]
media containing CUI is marked with applicable CUI markings.
3.8.4[b]
media containing CUI is marked with distribution limitations.
What to do
Confirm the applicable instructions
Check the source of the CUI, its category and the contract or agency instructions. If the status or marking is unclear, use the approved clarification route. Proprietary information is not automatically CUI, and an absent marking does not by itself settle the question.
Mark the actual media
Follow applicable CUI marking guidance for the medium and contents. NARA links the Marking Handbook, SF 901 cover sheet and SF 902/903 media labels. A label inside one Office file may not mark the physical drive or other copies. Do not treat a custom Word template as an official form.
Check distribution restrictions separately
Apply applicable limited dissemination controls only as authorized by the designating agency and follow agency instructions. Do not invent NOFORN or export-related restrictions from a contractor preference. Sample the markings and applicable distribution limits on actual media, with harmless practice copies for exercises.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.4[a]
Compare markings on sampled CUI media with the applicable agency/CUI marking instructions.
Records to keep: Applicable guidance and authorization reference, media reference and actual marking review.
3.8.4[b]
Check applicable distribution limitations are marked under the authorized instructions; resolve uncertainty rather than inventing a limit.
Records to keep: Agency distribution instructions/approval, media markings and clarification records where needed.
Records to keep
Applicable marking instructions, source/agency clarification and media categories.
Marking and distribution-limit checks, corrections and authorized changes.
If a check fails
Keep uncertain media controlled and obtain clarification before distributing it. Correct the applicable markings and check known copies under the approved procedure; a new label does not authorize a previously unauthorized recipient.
Working with a small budget
Use official public guidance and existing Office/printing tools first. Microsoft Purview labels can support some electronic workflows where licensed and available, but do not determine CUI status or replace every physical marking.
Know who is responsible when CUI media leaves a controlled area. Protect access during the journey and keep enough records to explain release, custody and receipt.
Official requirement and assessment objectives
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.5
Objective
Official text
3.8.5[a]
access to media containing CUI is controlled.
3.8.5[b]
accountability for media containing CUI is maintained during transport outside of controlled areas.
What to do
Authorize the transfer and recipient
Confirm why the media must move, the authorized sender/custodian and recipient, approved destination and handling method. Include paper, drives and other media carried by staff or providers. Verify recipient details through an established route.
Protect access during the journey
Use the approved physical and, where applicable, cryptographic safeguards. Set handling restrictions for storage, unattended stops and handoffs. A courier booking or tracking number does not itself restrict access to the CUI.
Record release, handoffs and receipt
Maintain accountable transport records that link the actual media to authorized people and events. Obtain and check receipt under the approved process. Investigate delayed, missing, damaged or inconsistent handoffs rather than closing the row from a shipment notification.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.5[a]
Check access to the media is controlled under the actual transport method and authorized handling arrangements.
Records to keep: Transfer approval, recipient/custodian verification, protection method and handling observations.
3.8.5[b]
Trace media outside controlled areas through release, custody/handoffs and confirmed receipt.
Records to keep: Media reference, actual dated transport events, accountable custodians, receipt and discrepancy handling.
Records to keep
Approved transport methods, recipients/custodians and access safeguards.
Actual release, handoff, receipt and discrepancy records linked to the media.
If a check fails
For a missing receipt or possible loss/tampering, contact the responsible roles through the approved route, protect remaining media and invoke Incident Response as appropriate. Do not invent a receipt to close the record.
Working with a small budget
The free register can record custody without a specialist platform. Approved containers, secure transport and provider arrangements may cost money. Choose controls that actually fit the journey and obligations.
Protect digital media while it is being transported
For digital media containing CUI during transport, use cryptographic protection unless approved alternative physical safeguards protect its confidentiality. Record the actual safeguard and its verification.
Official requirement and assessment objectives
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.6
Objective
Official text
3.8.6
Determine if the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards.
What to do
Choose the protection for the actual journey
Identify digital media, transfer conditions and the approved protection. The requirement also permits alternative physical safeguards where they protect confidentiality. A sealed envelope is not always sufficient. Document the chosen approach, how it protects confidentiality and who approved it.
Check cryptography and key handling where used
Confirm the supported configuration, effective protection, authorized decryption/recovery access and applicable cryptographic requirements. For 3.13.11, validate the actual cryptographic module and deployment against FIPS requirements; a Windows edition, algorithm name or BitLocker checkbox alone does not prove that. Keep keys and passwords out of worksheets and separate from transported media through approved handling.
Check before release and after receipt
Use harmless test files and approved media to verify the intended protection and authorized recovery procedure without exposing keys. Confirm the actual protection is active before transporting CUI. For a physical alternative, verify its actual controls. Preserve receipt/accountability checks from 3.8.5 as well.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.6
Check the confidentiality protection actually used for digital CUI media during transport: cryptography with relevant implementation/key evidence, or the approved alternative physical safeguards.
Records to keep: Media/journey reference, safeguard decision, effective configuration or physical-control evidence, authorized safe check and release review.
Records to keep
Chosen transport safeguard and applicable cryptographic/physical requirements.
Actual protection, controlled key/recovery arrangements and verification before release.
If a check fails
Do not release media if the selected protection cannot be verified. Keep it controlled, use an approved alternative or repair the protection under an authorized procedure. Handle possible prior exposure through the incident process.
Working with a small budget
BitLocker may already be included in a supported Windows edition. Check removable-drive support, recovery handling and the actual configuration before relying on it. Hardware, managed keys or another approved safeguard may still require spending.
Decide which removable media can be used, where and for what operations. Encryption is one control; it does not decide whether a drive may be connected, read or used for an approved task.
Official requirement and assessment objectives
Control the use of removable media on system components.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.7
Objective
Official text
3.8.7
Determine if the use of removable media on system components is controlled.
What to do
Define permitted use
Identify approved media types/devices, users, systems and purposes, along with prohibited uses and exceptions. Include read, write, installation or execution restrictions as appropriate. Match technical controls and handling procedures to those decisions.
Apply supported controls to the actual systems
Use existing Windows policy, device controls or physical/procedural controls appropriate to the scope. The BitLocker policy that denies writes to unprotected removable drives does not block reads or all USB devices. Check already-installed devices, alternate ports and supported clients where relevant. Optional Defender/Purview features need their own entitlement and prerequisites.
Check allowed and blocked behavior safely
Use only approved test media with harmless files and an authorized test plan. Check the intended operations on representative endpoints and AVD clients, then review effective policy and records. Do not plug in a found drive, use malware or broadly block production devices as an exercise.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.7
Compare permitted removable-media use with actual system behavior and applicable handling controls, including relevant read/write/use restrictions.
Records to keep: Approved-use decision, scoped policy/physical controls, representative authorized checks and unresolved exceptions.
Records to keep
Permitted devices/media, users, systems, operations and approved exceptions.
Effective controls and actual safe allowed/blocked checks, with operational limitations.
If a check fails
If a control fails, stop the affected use and follow the approved exception or incident route. Make scoped, authorized changes with recovery planned; do not disable all ports and discover business dependencies afterward.
Working with a small budget
Start with supported built-in Windows controls and a practical handling policy. Intune, Defender for Endpoint/Business and Purview features are not included just because Office is installed. Avoid buying before checking the actual gap and existing entitlement.
Prohibit portable storage with no identifiable owner
An encrypted or branded drive can still have no identifiable owner. Identify a responsible individual, organization or project before permitted use; a device identifier is not an owner.
Official requirement and assessment objectives
Prohibit the use of portable storage devices when such devices have no identifiable owner.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.8
Objective
Official text
3.8.8
Determine if the use of portable storage devices is prohibited when such devices have no identifiable owner.
What to do
Define how ownership is established
Link approved portable storage to an accountable owner using your register and verification process. A serial number, vendor logo or handwritten name by itself may not establish that responsibility. Ownership does not replace authorization for a particular use.
Prohibit unowned portable storage
Communicate the rule and apply the handling/system controls that support it. A drive found in a meeting room, received without verified ownership or omitted from required records must not be used just because it looks familiar or appears encrypted.
Check the rule and handling route
Use a fictional request or approved known test device to check staff decisions and relevant controls. Do not connect unknown media to a CUI system to identify it. Use the approved isolation, reporting and authorized inspection route instead.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.8
Check portable storage with no identifiable owner is prohibited, with actual handling and system controls consistent with that rule.
Records to keep: Ownership records, prohibition/handling instructions, representative decisions and applicable enforcement observations.
Records to keep
Identifiable owner and approved-use references for portable storage.
Unowned-media handling/reporting and actual rule/enforcement checks.
If a check fails
Stop use and keep the device controlled through the approved handling route. If it was already connected or used, preserve relevant records and involve Incident Response. Do not investigate by trying it on another production machine.
Working with a small budget
A controlled register, clear rule and staff instructions can establish accountability without a new subscription. Technical enforcement may need additional configuration or tooling for your environment; the register alone does not block a device.
Follow the copies. A well-protected live system can still have an exposed backup disk, export, provider-held copy or restore staging area.
Official requirement and assessment objectives
Protect the confidentiality of backup CUI at storage locations.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.8.9
Objective
Official text
3.8.9
Determine if the confidentiality of backup CUI is protected at storage locations.
What to do
Identify backup copies and locations
Include relevant system and user backups containing CUI, offline/off-site media, service copies, exports and temporary restore locations. Map customer/provider duties and approved locations. Do not assume version history or a recycle bin is an independent backup.
Protect confidentiality at each location
Check authorized access, applicable cryptographic or alternative physical controls, key/recovery handling and provider evidence. One encrypted vault does not show that every exported copy, storage administrator or recovery key is controlled.
Check the actual stored copies
Review representative locations and permissions and use approved harmless test data for any technical access checks. Restore testing and immutability answer different questions; they do not alone establish confidentiality. Link gaps to an owner and verify corrections.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the media control worked.
3.8.9
Check confidentiality of backup CUI at actual storage locations, including applicable off-site/provider copies and access/key controls.
Records to keep: Backup/location inventory, provider duties/evidence, effective safeguards, permissions/key references and actual review results.
Records to keep
Backup copies/locations and accountable customer/provider roles.
Confidentiality safeguards, authorized access and actual stored-copy review records.
If a check fails
For exposed or uncertain copies, restrict access through an approved procedure while preserving required recovery and evidence. Investigate possible disclosure, fix the affected safeguards and check other copies before closing the finding.
Working with a small budget
Use existing backup tooling and the free register to find coverage gaps. Secure offline storage, an appropriate provider, key management or replacement media may cost money. Free storage is not automatically suitable for CUI.
Identify the actual cloud, Windows edition, device join, management authority and transfer paths first. These configuration examples have not been tested in a Microsoft tenant. Obtain authorization, scope a small test and agree recovery before changing a live system. A Microsoft subscription does not establish that a service is suitable for your CUI.
AD DS and hybrid joined Windows
Identify the GPO scope, local settings, any Intune policies and permitted removable-media use. Confirm which authority manages each setting and check effective policy on representative devices. A hybrid join does not resolve conflicting management settings by itself.
For a policy requiring BitLocker protection before writing to removable data drives, review Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Removable Data Drives → Deny write access to removable drives not protected by BitLocker. Check the linked documentation, supported edition and dependent recovery/startup settings before enabling it in an approved test scope.
When enabled, this policy makes unprotected removable data drives read-only. It does not deny reads, block every USB device or prove identifiable ownership. If the requirement is to deny use, choose appropriate supported device/use controls as well. Check permitted and prohibited operations with approved test media and harmless files.
Approve recovery arrangements before encryption or policy changes. Verify where recovery material is held and who can retrieve it for the relevant drive type. Do not assume operating-system drive escrow also proves removable-drive recovery. Keep keys and passwords out of this website and the registers.
Microsoft Entra joined Windows
With eligible Intune management, review the supported BitLocker removable-drive policy exposed through the RemovableDrivesRequireEncryption CSP setting. Check the applicable Intune configuration surface, OS/edition support, assignment and effective result; Entra join alone does not deploy it. A supported local Group Policy may also be available on an eligible Windows edition, but it needs controlled management and verification. Separate disk-encryption settings from device installation and read/write/use controls.
Commercial Microsoft 365 and Azure
Confirm CUI handling and contract requirements before using any service. Check Microsoft 365 permissions and sharing, but also follow exported, printed and backed-up copies. Optional Purview labels/DLP and Defender device control can support particular controls with eligible licenses and configuration; an Office subscription does not include every feature. A sensitivity label does not establish CUI status, authorize a recipient or mark every physical medium.
GCC, GCC High and Azure Government
Record the actual identity tenant and each service instance. GCC, GCC High, Azure Government and commercial services have different arrangements and feature availability. Before choosing Intune, Defender, Purview, AVD or backup features, verify that the exact capability is supported in your cloud and license, and that its data flows fit the approved boundary. Do not copy commercial endpoints or assume feature parity. Local Windows policies still depend on the host edition, management and effective configuration. Provider evidence and your own media controls remain necessary.
Azure Virtual Desktop: check the routes out of the session
Map session-host join, host pool, supported client, local drives, clipboard, printers, USB/device redirection and browser/application transfers. Decide which paths are permitted before selecting settings. AVD does not automatically prevent local copies or paper output.
Where the approved design blocks drive redirection, the documented host-pool path is Azure Virtual Desktop → Host pools → the pool → RDP Properties → Device redirection → Drive/storage redirection → Don’t redirect any drives. Review session-host policy too; the most restrictive setting applies. Do not assume an existing pool has the same default as a newly created pool.
For session-host Group Policy, Microsoft documents Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Device and Resource Redirection → Do not allow drive redirection, set to Enabled to block it. The corresponding supported Intune settings-catalog policy is another management path. Coordinate the documented host restart and user impact through an approved maintenance window before testing.
Check effective behavior from the actual supported clients and a fresh session using harmless files. Microsoft notes that blocking drive redirection through host GPO/Intune also blocks clipboard file transfer; text/images need separate controls. Review clipboard, printing and other device/browser channels independently. A single setting does not establish an enclave boundary or CMMC compliance.
BitLocker and backup checks
Confirm the actual drive type, active protection, authorized users and recovery procedure. Automatic Windows device encryption does not cover external USB drives. An encrypted percentage alone does not establish active protection or appropriate key handling. Check applicable FIPS requirements against the actual cryptographic module and deployment, including 3.13.11, rather than treating an algorithm name as proof.
Azure Backup documents vault/workload encryption, but inspect the actual backup service, permissions, key access, offline media, exports and restore storage in your scope. Encryption in one vault does not cover every copy. Use the backup and recovery guide for recovery planning; a successful restore or immutable setting alone does not prove backup confidentiality.
Included tools and costs to check
Start with the free Office materials, existing approved storage, physical controls and supported built-in Windows features. BitLocker enablement depends on Windows edition; management needs can add licensing. Defender for Endpoint/Business device control, Intune and Purview features have their own prerequisites and entitlements. Check them before buying. Secure containers, appropriate media, transport, sanitization and destruction may also cost money. No free product removes those responsibilities.
These situations are fictional. Discuss them with the media custodian, system owner, backup owner and person who approves transfers or release. Use the Word exercise pack for facilitator notes. Record what participants actually did and what was only proposed. These example answers are not test results.
Supports 3.8.1, 3.8.2, 3.8.4, 3.8.5, 3.8.6
The drive arrived, but nobody checked who received it
In this fictional situation, a team prepares an approved encrypted drive and a paper package for a customer visit. The paper has been left beside a shared printer. The drive register names the sender, but the recipient was changed in an unverified message. A courier screen says delivered. There is no confirmed handoff to an authorized recipient, and nobody checked the applicable media markings or distribution instructions.
Discuss
What must be checked for the paper and the drive before release?
What does the encryption result establish, and what remains unknown?
How would you verify the recipient, custody and actual receipt?
What a useful response includes
Protect the paper and drive, confirm authorized access and check applicable markings and distribution instructions.
Verify the recipient and transport method through the approved route. Record actual release, accountable handoffs and confirmed receipt; investigate the missing handoff.
Verify the chosen digital transport protection and controlled recovery arrangements. Encryption does not establish recipient authorization, markings or custody.
Lesson: A delivery notification is not the same as an accountable handoff to the authorized recipient. Paper and digital media both need handling controls.
Record: Keep fictional media and transport references, expected versus observed decisions, unresolved checks, responsible roles and a safe verification plan. No real shipment or CUI transfer is part of this exercise.
Supports 3.8.7, 3.8.8
An encrypted drive with no known owner
In this fictional situation, someone finds a branded USB drive and asks to use it because it appears encrypted. No responsible owner or approved use can be verified. The team points to its policy denying writes to unencrypted drives. Its AVD host pool blocks drive redirection, but nobody has checked local devices, other transfer channels or supported client behavior.
Discuss
Does the brand, encryption or serial number establish an identifiable owner?
What does the BitLocker write restriction fail to cover?
What safe checks would establish permitted media use without inserting the found drive?
What a useful response includes
Prohibit use of the unowned device and follow the approved controlled-handling and reporting route. Do not connect it to a CUI system or another production machine to investigate.
Keep ownership, approved use and encryption as separate checks. A write restriction does not block reads, every USB device or every unowned encrypted drive.
Plan authorized allowed/blocked checks with known approved test media and harmless files. Review effective endpoint and AVD controls, including separate clipboard, printing and browser paths where relevant.
Lesson: A familiar logo and an encryption policy do not identify the owner or authorize the device. AVD drive restrictions cover a particular transfer path.
Record: Record the fictional request decision, relevant policy gaps, tests proposed but not performed, an owner and due date. No unknown-media insertion or production policy change is included.
Supports 3.8.1, 3.8.3, 3.8.9
The disposal ticket missed the backup copy
In this fictional situation, a failed laptop drive is approved for disposal and another drive is proposed for reuse. A generic vendor certificate does not identify the failed drive or its verified result. The team says both drives were encrypted, so release should be safe. A backup export also remains on an external disk in an unlocked storage area, with recovery details recorded beside it. Retention and incident holds have not been checked.
Discuss
Which decisions and records are needed for disposal versus reuse?
What happens when damaged media cannot be sanitized or the result is unverified?
Which backup copies, locations, access and recovery arrangements still need review?
What a useful response includes
Check retention/evidence holds and recovery needs, keep media controlled and select authorized medium-specific methods. Verify sanitization or destruction before disposal and sanitization before reuse release.
Link actual media identifiers to execution, verification/validation and release decisions. Keep failed or unverifiable media controlled and obtain an approved alternative; an encrypted screen or generic certificate is insufficient.
Protect the backup copy and its authorized access/key arrangements, check other copies and storage locations, and follow the incident route for possible exposure. Do not destroy needed evidence or the only required recovery copy as an exercise.
Lesson: A disposal ticket does not prove sanitization, and disposing of one drive does not protect the backups left behind.
Record: Record fictional media, hold/recovery decisions, missing assurance, blocked release and backup confidentiality actions. Assign authorized verification separately. No real erasure, destruction or key handling is performed.
Five free Word and Excel materials
Download a copy and adapt it in your approved environment. Blank inputs and fictional examples are separate. Use restricted references; keep CUI, credentials, detailed system records and evidence in approved storage. The templates do not calculate a compliance score.
Excel
Media and storage register
Record paper and digital media, identifiable owners, approved users, storage, markings, removable-use controls and backup protection references.
Ready for record review means a row is prepared for someone to examine. It is not verified protection, sanitization, release approval or a compliance finding. Keep remaining limitations and next actions explicit.
Turn a missing check into an assigned action
In a fictional review, the backup disk is encrypted but nobody can show who may retrieve it or its recovery material. The team keeps 3.8.9 as Evidence to check in the Level 2 gap-and-action worksheet, links the restricted media record and assigns a safe review. It does not mark the objective met from encryption alone.
Sources reviewed October 28, 2026. Official text is separate from our suggestions. Product documentation supports the features and limits described; it does not establish that your deployment works or that a service is suitable for your CUI. Sanitization methods, access authorization and provider responsibilities depend on your actual systems and obligations. This guide does not choose a sanitization technique or approve a cloud service for your CUI.
Nine Media Protection requirements and 15 objectives. The archived assessment edition is used with the Revision 2 baseline; singleton identifiers remain unchanged.
Media Protection includes paper and digital media, transport, reuse, removable devices and backup confidentiality. The transport requirement includes alternative physical safeguards.
Official marking guidance, the CUI Marking Handbook, SF 901 cover sheet and SF 902/903 media labels. Use the applicable agency instructions; this guide does not supply an official label.
Current supporting sanitization guidance. Select an appropriate method for the actual medium and verify/validate the outcome. This is not a replacement CMMC baseline.
Removable-drive encryption policy and recovery planning. Denying writes to unprotected removable drives is not a general read block or proof of approved ownership.
Separate built-in Windows installation controls from licensed Defender for Endpoint/Business features and Purview DLP. Check feature-specific prerequisites and cloud availability.
Host-pool and session-host policies combine; the most restrictive setting applies. Drive restrictions do not cover every clipboard, printing or browser transfer path.
Azure Backup documents vault and workload encryption. Check the actual service, access, keys and copies; one vault setting does not cover every export or restore location.
Email cmmc@purposefulsecurity.com with a general description. Keep CUI, credentials, detailed system records, logs, evidence and completed worksheets in your approved environment. Do not email them to us.