- Find the media first: backup drives in desk drawers, printed drawings, retired disks in a closet — the unknown media population is the real gap.
- Shrink the problem: the fewer places CUI legitimately exists on portable media and paper, the smaller the storage perimeter to control.
- Assign physical custody — a named owner per storage location, with check-in and check-out where media moves.
03.08.01OFFICIAL TITLEPENDING NIST SME REVIEW
03.08.01 — Media Storage
03.08 Media Protection · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires physically controlling and securely storing system media that contain CUI, whether digital or non-digital.
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
CUI on a USB drive, backup disk, tape, or paper printout sits outside the system's technical protections. Wherever such media exists, it lives in controlled storage — a locked container, room, or media library — and its whereabouts are known rather than assumed.
Across revisions
Substantively continuous with Rev. 2's 3.8.1, retitled Media Storage.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- A media register or storage-location list with custodians
- Physical storage arrangements demonstrable on a walkthrough
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |