AO coverage. Addresses all Media Protection objectives — physical control and secure storage, for both paper and digital media containing CUI.

Paper: physical control. Printed CUI is generated only at two secure-release printers, one in engineering and one in a supervised area of the shop floor. Jobs hold until the owner badges at the device, so nothing sits in an output tray. Each printed set carries the required markings and a copy number, and travelers are signed out to a work center and signed back in at job close. Clean-desk is enforced at end of shift by the supervisor walk, which is the only reason it actually happens.

Paper: secure storage. Between uses, printed CUI goes into a locking cabinet in the engineering area or the lockable drawer at the work center. Keys are on the physical access device register with named holders. Overnight, no CUI paper remains outside a locked container anywhere in the building; the supervisor walk checklist includes the work-center drawers.

Digital: physical control. Removable digital media that may hold CUI is organization-issued, asset-tagged, and hardware-encrypted. It is signed out from the IT media cabinet with the holder, purpose, and expected return date, and it is not left in a laptop bag overnight. Media that arrives from a customer is logged at receipt and treated as CUI until determined otherwise.

Digital: secure storage. The media cabinet is a locking cabinet inside the badge-controlled IT area — two barriers, not one. Backup tapes waiting for pickup are in the same cabinet. Servers and network gear holding CUI are in the server room, which requires a badge on the outer IT door and a separate key on the room itself; the badge group for that room is six people.

Maintenance. Monthly inventory of the media cabinet against the register, with any discrepancy escalated the same day. Quarterly audit of key holders. Annual review of which printers can produce CUI and whether secure release is still enforced after firmware updates, which have silently reset it before.

Accepted gap. The shop-floor secure-release printer sits in an area other employees walk past. It is positioned so the output faces the supervisor's station and the release requires a badge tap, but it is not in a locked room. The compensating measure is that shop-floor prints are single-job, retrieved immediately, and returned to the work-center drawer.

• Secure print release configuration for the two CUI-capable printers
• Media cabinet register with sign-out entries and the monthly inventory result
• Badge group membership for the IT area and key holder list for the server room
• Supervisor end-of-shift walk checklist with completed entries
• Traveler sign-out and return log for a recent job