Skip to content
ControlVerdict
Sign in
MP.L2-3.8.5CMMC Level 2Level 2

Media Accountability

Submit your own example

Practice statement

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.8.5.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    access to media containing CUI is controlled; and

    1 example covers this

  2. [b]

    accountability for media containing CUI is maintained during transport outside of controlled areas.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MP.L2-3.8.5Media Accountability
    Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

    • [a]

      access to media containing CUI is controlled; and

    • [b]

      accountability for media containing CUI is maintained during transport outside of controlled areas.

    Chain-of-custody form rides along with every drive that leaves the building

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Media Accountability objectives: controlling access to media containing CUI, and maintaining accountability for that media during transport outside controlled areas.

    Access control before it moves. Media is issued from the locked cabinet only to a roster member, against an approved transport request that names the recipient organization, the reason, the contents, and the authorizing manager. The requester and the authorizer are different people.

    Chain of custody. A numbered form travels with the media and records every transfer: who released it, who accepted it, date, time, and signature at each hop, including the courier. The form is a two-part document — one copy travels, one stays with the media register — so a lost form does not erase the record. The recipient signs and returns a scan; a form not returned within the expected window opens a ticket automatically at the register review.

    Packaging and transport. Media is hardware-encrypted (the portable storage encryption pattern covers the cryptography) and shipped in an opaque, tamper-evident inner package inside a plain outer package with no markings visible externally. We use a tracked courier with signature required; regular mail is not permitted. Hand-carry by an employee is allowed for local runs, with the media kept on the person rather than in a checked bag or an unattended vehicle.

    Register. The media register is the accountability record: asset tag, contents description, current custodian, current location, and status. Anything in transit shows as in-transit with the expected arrival, and the register is reviewed weekly for items past their expected arrival.

    Return or disposition. On arrival the recipient confirms receipt and either returns the media or confirms destruction, and the register is closed out with that evidence. Media not returned within the agreed window escalates to the contract manager.

    Maintenance. Quarterly audit sampling three transports for a complete signature chain; annual review of courier terms and the tamper-evident packaging supply.

    Accepted gap. Tamper evidence tells us a package was opened, not who opened it, and the courier's internal handling is outside our visibility. Encryption is the real protection in transit; the packaging and the chain of custody exist to make a compromise visible rather than to prevent it.

    What the evidence looks like

    • Transport request form showing separate requester and authorizer
    • Completed chain-of-custody forms with signatures at each hop
    • Media register export showing custodian, location, and in-transit status
    • Courier receipt with tracking and signature confirmation
    • Quarterly transport audit results

    Environment

    Occasional courier runs of large design files to a prime, plus a monthly tape rotation to an off-site vault. Two or three transports a month, which is exactly the volume at which people stop being careful.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.