- Chain-of-custody records and locked transport containers cover the mechanics; courier agreements should name accountability terms explicitly.
- The best transport is none: replicating data over encrypted channels removes the physical trip, and with it most of this requirement's operational burden.
3.8.5OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.8.5 — Media transport accountability
3.8 Media Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
When media leaves controlled areas — tapes to offsite storage, a drive carried to another site — custody stays unbroken and documented: who has it, in what container, from when to when. A lost tape with no custody record is unexplainable by construction.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Custody logs for media movements outside controlled areas
- Courier or offsite-storage agreements with accountability terms
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |