Physically control and securely store any media — paper or digital — that holds CUI.
What it actually means
Media that contains CUI — printouts, USB drives, backup tapes, disks — must be physically controlled and stored securely. In practice that means locking CUI paper and removable media in a cabinet or controlled room, restricting who can get to it, and not leaving it sitting out. This applies to both paper and digital media.
Pass or fail — an assessor needs a "yes" to each
- Is CUI media (paper and digital) physically controlled and stored in a secured location?
- Is access to stored CUI media restricted to authorized people?
What to have ready
- Media-protection policy
- Description or photos of secured storage (locked cabinet, controlled room)
Where teams trip up
- CUI printouts left on desks or in open bins
- Backup drives stored in an unsecured area
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →