Threat Actors:   

i) Hard drives/memory in computers, scanners, copiers

ii) CD/DVD, thumb drives

iii) Paper files/reports

·  Processes or procedures to identify Federal Contract Information or Controlled Unclassified Information (CUI).

·  An inventory of process/or tools used to sanitize media before it is released for reuse or destroyed for disposal.

·   Documentation that shows who approved and who sanitized the media or a signed form that verifies the media was destroyed securely.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Procedures that identify how information system media is protected i.e. physically controlled or securely controlled.

·  Organizational policy and processes that address access controls and media access restrictions.

·  Inventories, media check-in check-out log.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Procedures that address access control and media protection to ensure that access is limited and restricted to authorized users, and that processes exist for granting temporary or emergency access.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  The company information system media protection policy to identify the list of media marking security attributes.  

·  Evaluate media that contain CUI to determine the media has appropriate markings.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Your company's policy for the control of CUI to ensure that it addresses; approval of individual access to CUI, controls for transporting CUI, and safeguards to protect media during transport such as encryption, locked containers, or locked rooms.  

·  Your company's policy, physical and environmental protection policy, and procedures for transporting CUI.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

Company's policy and related procedures on protecting CUI which should address the use of encryption and transport outside the physical perimeter. 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

System media use policy and procedures or Rules of Behavior to identify restrictions for removable media, and if removable media is authorized for the system. 

Threat Actors:   

Compromised storage may contain malware or malicious code. Plugging an infected storage device into a system can allow an actor to compromise your network.

·  Media Protection Policy to identify the conditions and type of portable media authorized for CUI.  

·  Procedures that require inventories of portable media consistent with this practice.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Procedures and controls that protect the integrity and availability of backup information at storage locations.

·  Evidence that backups are encrypted on media when removed from a secured facility.

·  Evidence that encryption is FIPS 140-2 complaint.

This practice ensures confidentiality of backup CUI located at storage locations is protected.