03.08.01 —

What this control requires

Source: NIST SP 800-171 R3 §03.08.01 (official control text).

Why this matters

Uncontrolled media — USB drives, external hard drives, backup tapes, printed reports, or laptops — can walk out the door with sensitive customer data, intellectual property, or authentication credentials. Media storage controls prevent theft, loss, and unauthorized access by enforcing physical custody, tracking checkout, and requiring secure containers. This control protects CUI at rest when it exists outside production systems, closing the gap between digital security and physical reality. Without it, a single lost drive or unsecured filing cabinet can trigger a breach notification.

What evidence assessors expect

Assessors typically look for: photo, PDF, CSV export. FORCE coaches you through the exact implementation steps and captures each artifact in-platform.

Related controls