Level 5 CMMC - CMMC Practices

MP.3.122  

Reference: CMMC 1.02

Family: MP

Level Introduced: 3

Practice:
Mark media with necessary CUI markings and distribution limitations.

CMMC Clarification:
All media (e.g., USB drives, CDs, DVDs, diskettes, hard drives, and paper) must be properly marked to alert individuals to the presence of Controlled Unclassified Information (CUI) stored on the media. Since the media itself may be small and provide limited space to mark it you should at a minimum mark it as “Controlled” or CUI” and the designating agency. If the media is hard to mark alternate methods may be approved to indicate the presence of CUI. For example, a company may place a CUI banner on the desktop background image or monitor attached to the system. They could also require the user to accept a banner message stating CUI may be present on the system.

Example
You were recently contacted by the project manager for a new Department of Defense program at your company. The project manager said she wanted the CUI with the program properly protected. After speaking with her, most of the protections will be provided as part of the organization’s cybersecurity capabilities infrastructure. She also mentions that the project team will use several USB drives to share certain data sets. You tell her that the USB drives the organization provides have encryption built into the device. You explain while this protects the confidentiality of the data the team must ensure the USB drives are externally marked to indicate the presence of CUI. The project manager thanks you for the reminder and has her team label the outside of each USB drive with an appropriate CUI label.

3.8.4

Mark media with necessary CUI markings and distribution limitations.

Discussion:
The term security marking refers to the application or use of human-readable security attributes.
System media includes digital and non-digital media. Marking of system media reflects applicable federal laws, Executive Orders, directives, policies, and regulations. See [NARA MARK].

*The implementation of this requirement is per marking guidance in [32 CFR 2002] and [NARA CUI]. Standard Form (SF) 902 (approximate size 2.125” x 1.25”) and SF 903 (approximate size 2.125” x .625”) can be used on media that contains CUI such as hard drives, or USB devices. Both forms are available from https://www.gsaadvantage.gov. SF 902: NSN 7540-01-679-3318. SF 903: NSN 7540-01-679-3319.

Source: NIST Special Publication 800-171 Rev. 2

MP-3

MEDIA MARKING

Description:
The organization:
    a. Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
    b. Exempts [Assignment: organization-defined types of information system media] from marking as long as the media remain within [Assignment: organization-defined controlled areas].

Supplemental Guidance:
The term security marking refers to the application/use of human-readable security attributes. The term security labeling refers to the application/use of security attributes with regard to internal data structures within information systems (see AC-16). Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Security marking is generally not required for media containing information determined by organizations to be in the public domain or to be publicly releasable. However, some organizations may require markings for public information indicating that the information is publicly releasable. Marking of information system media reflects applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Related controls: AC-16, PL-2, RA-3.

Source: NIST Special Publication 800-53 Rev. 4

Source: CMMC v1.02