Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Back to results
NIST 800-171 R-3.8.2

Limit Access to CUI on Media

Official citation: 3.8.2

Class: core · Severity: high

Statement of the obligation — verify against source

3.8.2

What it means

Limit access to the CUI held on system media to authorized users. Enforce this by physically controlling the media and using secure storage — locked drawers or cabinets or a controlled media library — along with inventories, accountability, and check-out/return procedures.

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.