Skip to content
ControlVerdict
Sign in
MP.L2-3.8.4CMMC Level 2Level 2

Media Markings

Submit your own example

Practice statement

Mark media with necessary CUI markings and distribution limitations.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.8.4.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    media containing CUI is marked with applicable CUI markings; and

    1 example covers this

  2. [b]

    media containing CUI is marked with distribution limitations.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MP.L2-3.8.4Media Markings
    Mark media with necessary CUI markings and distribution limitations.

    • [a]

      media containing CUI is marked with applicable CUI markings; and

    • [b]

      media containing CUI is marked with distribution limitations.

    Marking happens at creation: label templates, document headers, drive faceplates

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Media Markings objectives: media containing CUI is marked with the applicable CUI markings and with distribution limitations.

    Marking at creation, not at audit. Templates for drawings, reports, and slide decks carry the banner and portion marking fields in the header and footer, populated from a document property. Authors choose the category and the dissemination control from a picklist derived from the contract's requirements rather than typing free text, which is what eliminated our inconsistent markings. The applicable markings and their exact form come from the customer's contract and the registry; we do not invent local variants.

    Distribution limitations. The same picklist populates the distribution statement and any limited dissemination control the contract imposes. Because the fields are properties rather than typed text, a change to the statement updates every page, and the export to PDF preserves it.

    Digital media. Sensitivity labels apply the marking to the file itself and travel with it, including into headers and footers on Office formats. Files placed on removable media inherit the label from the source library. The label name shown to users matches the marking language in the policy so people are not translating between two vocabularies.

    Physical media. Every issued drive and every tape carries a pre-printed external label with the marking, the distribution statement, the asset tag, and the custodian. Printed sets carry the banner on every page, the marking on the cover, and the distribution statement on the cover — the cover-only pattern is a common finding and we check for it during review.

    Verification. Design review packages are checked for markings by the reviewer before release, and the same check runs before anything is written to removable media. A monthly sample of ten files from the enclave libraries is inspected for correct labeling.

    Maintenance. Template and picklist reviewed annually and whenever a contract imposes different markings. Anyone who authors CUI takes a short marking module.

    Accepted gap. Native CAD files cannot carry the marking inside the file format in a way downstream tools preserve. They are stored only in labeled libraries where the container marking applies, and any export or plot is produced through a template that applies the marking to the output.

    What the evidence looks like

    • Document templates showing the marking and distribution statement fields
    • Sensitivity label configuration including the header and footer content applied
    • Photograph of a labeled drive and tape (asset tag and custodian visible)
    • Monthly marking sample results with any remediation tickets
    • Marking guidance document tied to contract requirements

    Environment

    Engineering group producing drawings, analysis reports, and occasional printed sets for design reviews. Digital-first, but the printed sets are where marking failures used to show up.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.