Practice MP.L2-3.8.2 Details - Revision history

David at 00:48, 16 March 2025

2025-03-16T00:48:19Z

← Older revision		Revision as of 00:48, 16 March 2025
Line 12:		Line 12:
	'''Examine'''		'''Examine'''

	[SELECT FROM: System media protection policy; procedures addressing media storage;physical and environmental protection policy and procedures; access control policy and procedures; system security plan; system media; designated controlled areas; other relevant documents or records].		[SELECT FROM: System media protection policy; procedures addressing media storage; physical and environmental protection policy and procedures; access control policy and procedures; system security plan; system media; designated controlled areas; other relevant documents or records].

	'''Interview'''		'''Interview'''

	[SELECT FROM: Personnel with system media protection and storage responsibilities;personnel with information security responsibilities].		[SELECT FROM: Personnel with system media protection and storage responsibilities; personnel with information security responsibilities].

	'''Test'''		'''Test'''
Line 22:		Line 22:
	[SELECT FROM: Organizational processes for storing media; mechanisms supporting or implementing secure media storage and media protection].		[SELECT FROM: Organizational processes for storing media; mechanisms supporting or implementing secure media storage and media protection].
	=== DISCUSSION ===		=== DISCUSSION ===
	Access can be limited by physically controlling system media and secure storage areas.Physically controlling system media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return system media to the media library, and maintaining accountability for all stored media. Secure storage includes a locked drawer, desk, or cabinet, or a controlled media library.		Access can be limited by physically controlling system media and secure storage areas. Physically controlling system media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return system media to the media library, and maintaining accountability for all stored media. Secure storage includes a locked drawer, desk, or cabinet, or a controlled media library.
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	Limit physical access to CUI to people permitted to access CUI. Use locked or controlled storage areas and limit access to only those allowed to access CUI. Keep track of who accesses physical CUI in an audit log.		Limit physical access to CUI to people permitted to access CUI. Use locked or controlled storage areas and limit access to only those allowed to access CUI. Keep track of who accesses physical CUI in an audit log.

David at 00:20, 16 March 2025

2025-03-16T00:20:06Z

← Older revision		Revision as of 00:20, 16 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/cmmc/~~documentation.html~~ CMMC Level 2 Assessment Guide] from the ~~Office of the Under Secretary~~ of Defense ~~Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 2 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

Wikiadmin: Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 2 Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == MP.L2-3.8.2 – MEDIA ACCESS == === SECURITY REQUIREMENT === Limit access to CUI on system media to authorized users. === ASSESSMENT OBJECTIVES === Determine if:..."

2022-02-25T23:23:46Z

Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 2 Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == MP.L2-3.8.2 – MEDIA ACCESS == === SECURITY REQUIREMENT === Limit access to CUI on system media to authorized users. === ASSESSMENT OBJECTIVES === Determine if:..."

New page

'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 2 Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.'''

For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

== MP.L2-3.8.2 – MEDIA ACCESS ==
=== SECURITY REQUIREMENT ===
Limit access to CUI on system media to authorized users.
=== ASSESSMENT OBJECTIVES ===
Determine if:
: [a] access to CUI on system media is limited to authorized users.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
'''Examine'''

[SELECT FROM: System media protection policy; procedures addressing media storage;physical and environmental protection policy and procedures; access control policy and procedures; system security plan; system media; designated controlled areas; other relevant documents or records].

'''Interview'''

[SELECT FROM: Personnel with system media protection and storage responsibilities;personnel with information security responsibilities].

'''Test'''

[SELECT FROM: Organizational processes for storing media; mechanisms supporting or implementing secure media storage and media protection].
=== DISCUSSION ===
Access can be limited by physically controlling system media and secure storage areas.Physically controlling system media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return system media to the media library, and maintaining accountability for all stored media. Secure storage includes a locked drawer, desk, or cabinet, or a controlled media library.
=== FURTHER DISCUSSION ===
Limit physical access to CUI to people permitted to access CUI. Use locked or controlled storage areas and limit access to only those allowed to access CUI. Keep track of who accesses physical CUI in an audit log.

'''Example'''

Your company has CUI for a specific Army contract contained on a USB drive. In order to control the data, you establish specific procedures for handling the drive. You designate the project manager as the owner of the data and require anyone who needs access to the data to get permission from the data owner [a]. The data owner maintains a list of users that are authorized to access the information. Before an authorized individual can get access to the USB drive that contains the CUI they have to fill out a log and check out the drive. When they are done with the data, they check in the drive and return it to its secure storage location.

'''Potential Assessment Considerations'''
* Is a list of users who are authorized to access the CUI contained on system media maintained [a]?
=== KEY REFERENCES ===
* NIST SP 800-171 Rev 2 3.8.2