MP.L2-3.8.2  

Reference: CMMC v2.13

Family: MP

Level Introduced: 2

Title: Media Access

Practice:
Limit access to CUI on system media to authorized users.

Further Discussion:
Limit physical access to CUI to people permitted to access CUI. Use locked or controlled storage areas and limit access to only those allowed to access CUI. Keep track of who accesses physical CUI in an audit log.

Example
Your company has CUI for a specific Army contract contained on a USB drive. In order to control the data, you establish specific procedures for handling the drive. You designate the project manager as the owner of the data and require anyone who needs access to the data to get permission from the data owner [a]. The data owner maintains a list of users that are authorized to access the information. Before an authorized individual can get access to the USB drive that contains the CUI they have to fill out a log and check out the drive. When they are done with the data, they check in the drive and return it to its secure storage location.

Potential Assessment Considerations
• Is a list of users who are authorized to access the CUI contained on system media maintained [a]?

Source: CMMC v2.13