MP.L2-3.8.4 Media Markings

Mark media with necessary CUI markings and distribution limitations.

Source: NIST SP 800-171 Rev 2 3.8.4

Discussion: The term security marking refers to the application or use of human-readable security attributes. System media includes digital and non-digital media. Marking of system media reflects applicable federal laws, Executive Orders, directives, policies, and regulations. See [NARA MARK]. [27] The implementation of this requirement is per marking guidance in [32 CFR 2002] and [NARA CUI]. Standard Form (SF) 902 (approximate size 2.125” x 1.25”) and SF 903 (approximate size 2.125” x .625”) can be used on media that contains CUI such as hard drives, or USB devices. Both forms are available from https://www.gsaadvantage.gov.

Assessment Objectives:

Determine if:

• [a] media containing CUI is marked with applicable CUI markings; and
• [b] media containing CUI is marked with distribution limitations.

Examine: [SELECT FROM: System media protection policy; procedures addressing media marking; physical and environmental protection policy and procedures; security plan; list of system media marking security attributes; designated controlled areas; other relevant documents or records].

Interview: [SELECT FROM: Personnel with system media protection and marking responsibilities; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for marking information media; mechanisms supporting or implementing media marking].

SPRS Score: 1

POA&M Allowed: Yes