Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Back to results
NIST 800-171 R-3.8.1

Protect System Media Containing CUI

Official citation: 3.8.1

Class: core · Severity: high

Statement of the obligation — verify against source

3.8.1

What it means

Physically control and securely store all media that contains CUI, both paper and digital — disks, tapes, external and removable drives, flash media, microfilm, and printouts. Keep media in locked drawers, cabinets, or a controlled media library; inventory it, maintain accountability, and use check-out/return procedures so only authorized people can reach it.

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.