CMMC MP.3.122 - Implement CUI Markings and Limit Distribution

CMMC MP.3.122 - Implement CUI Markings and Limit Distribution

Requirement text: MP.3.122: Mark media with necessary CUI markings and distribution limitations.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
The term security marking refers to the application or use of human-readable security
attributes. System media includes digital and non-digital media. Marking of system media
reflects applicable federal laws, Executive Orders, directives, policies, and regulations.

CMMC CLARIFICATION
All media (e.g., USB drives, CDs, DVDs, diskettes, hard drives, and paper) must be properly
marked to alert individuals to the presence of Controlled Unclassified Information (CUI)
stored on the media. Since the media itself may be small and provide limited space to mark
it you should at a minimum mark it as “Controlled” or CUI” and the designating agency. If
the media is hard to mark alternate methods may be approved to indicate the presence of
CUI. For example, a company may place a CUI banner on the desktop background image or
monitor attached to the system. They could also require the user to accept a banner message
stating CUI may be present on the system.

Example
You were recently contacted by the project manager for a new Department of Defense
program at your company. The project manager said she wanted the CUI with the program
properly protected. After speaking with her, most of the protections will be provided as part
of the organization’s cybersecurity capabilities infrastructure. She also mentions that the
project team will use several USB drives to share certain data sets. You tell her that the USB
drives the organization provides have encryption built into the device. You explain while
this protects the confidentiality of the data the team must ensure the USB drives are
externally marked to indicate the presence of CUI. The project manager thanks you for the
reminder and has her team label the outside of each USB drive with an appropriate CUI label.

References
• NIST SP 800-171 Rev 1 3.8.4
• NIST CSF v1.1 PR.PT-2
• CERT RMM v1.2 MON:SG2.SP4
• NIST SP 800-53 Rev 4 MP-3

    • Related Articles

    • CMMC MP.2.120 - Limit Access to CUI on System Media

      Requirement text: MP.2.120: Limit access to CUI on system media to authorized users. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Access can be limited by physically controlling system media and secure storage areas. Physically controlling system ...

    • CMMC MP.3.125 - Encrypt CUI on Digital Media

      Requirement text: MP.3.125: Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 ...

    • Media Protection: SP 800-171 Security Family 3.8

      Media protection is a requirement that addresses the defense of system media, which can be described as both digital and non-digital. Examples of digital media include: diskettes, magnetic tapes, external/removable hard disk drives, flash drives, ...

    • CMMC MP.2.119 - Protect System Media Containing CUI

      Requirement text: MP.2.119: Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 System media includes digital and non-digital media. Digital media ...

    • CMMC SC.3.185 - Implement Cryptography Mechanisms to Protect CUI unless Physical Safeguards

      Requirement text: SC.3.185: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 This ...