03.08 Media Protection (MP)

Phase 1 - A suggested method would be to include in your policy, a statement that Media Protection should explicitly address the following: First, we need to implement strict access controls, limiting who can access CUI stored on any media, whether it's a hard drive, USB drive, or even printed documents. This should include strong authentication and authorization measures. Second, we must detail procedures for protecting media during transport, including encryption for digital media and secure handling for physical media. Third, the policy needs to outline a clear process for sanitizing or destroying media containing CUI when it's no longer needed, specifying approved methods like degaussing or physical destruction to prevent any possibility of data recovery. Finally, we should mandate regular training for all personnel on these procedures and conduct periodic audits to ensure compliance. This comprehensive approach will help us meet the requirements of NIST 800-171 Revision 3 and protect our CUI.