03.08.02 —

What this control requires

Source: NIST SP 800-171 R3 §03.08.02 (official control text).

Why this matters

Media Access controls protect CUI stored on physical devices—USB drives, external hard drives, backup tapes, printed documents, laptops—from unauthorized access, theft, or loss. Without formal media handling procedures, sensitive data walks out the door in pockets, gets left in meeting rooms, or sits in unlocked storage where anyone can grab it. This control requires tracking who has what media, implementing checkout/return processes, and maintaining inventories so the organization knows where CUI-bearing devices are at all times. It's the difference between 'we think Bob has that backup drive' and 'our log shows Bob checked out drive #47 on Tuesday and it's due back Friday.'

What evidence assessors expect

Assessors typically look for: photo, CSV export, PDF. FORCE coaches you through the exact implementation steps and captures each artifact in-platform.

Related controls