Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment and Monitoring
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity
  15. 03.15: Planning
  16. 03.16: System and Services Acquisition
  17. 03.17: Supply Chain Risk Management

Security Requirements for 03.08.02 Media Access

System media include digital and non-digital media. Access to CUI on system media can be restricted by physically controlling such media. This includes conducting inventories, ensuring that procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for stored media. For digital media, access to CUI can be restricted by using cryptographic means. Encrypting data in storage or at rest is addressed in 03.13.08.

Evidence

  1. 03.08.02

    Restrict access to CUI on system media to authorized personnel or roles.