Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

NIST SP 800-171 CUI Protection Center

03.08.07 — Media Use

Read the official CUI requirement and assessment content, then use the separately labeled Bare Metal Cyber perspective to connect it to implementation, evidence, and sustained operation.

1Parameters
1Source controls
2Assessment objectives
3Assessment methods

03.08 — Media Protection · NIST SP 800-171 Revision 3

Active
Official NIST requirement content

Security requirement

  1. a.Restrict or prohibit the use of [Organization-defined: types of system media].
  2. b.Prohibit the use of removable system media without an identifiable owner.
Official NIST discussion

Discussion

In contrast to requirement 03.08.01, which restricts user access to media, this requirement restricts or prohibits the use of certain types of media, such as external hard drives, flash drives, or smart displays. Organizations can use technical and non-technical measures (e.g., policies, procedures, and rules of behavior) to control the use of system media. For example, organizations may control the use of portable storage devices by using physical cages on workstations to prohibit access to external ports or disabling or removing the ability to insert, read, or write to devices. Organizations may limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Organizations may also control the use of portable storage devices based on the type of device — prohibiting the use of writeable, portable devices — and implement this restriction by disabling or removing the capability to write to such devices. Limits on the use of organization-controlled system media in external systems include restrictions on how the media may be used and under what conditions. Requiring identifiable owners (e.g., individuals, organizations, or projects) for removable system media reduces the risk of using such technologies by allowing organizations to assign responsibility and accountability for addressing known vulnerabilities in the media (e.g., insertion of malicious code).

Official organization-defined parameters

Tailoring decisions required

Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.

types of system mediaorganization-defined types of system mediatypes of system media with usage restrictions or that are prohibited from use are defined.
Bare Metal Cyber interpretation

Implementation perspective

Treat Media Use as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to CUI media accountability, access, marking, storage, transport, sanitization, and disposal.

  1. Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
  2. Resolve every organization-defined parameter through an approved governance and tailoring process.
  3. Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
  4. Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
  5. Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

  • Which CUI assets, data flows, users, and services are protected by this requirement?
  • Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
  • Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
  • What change, incident, or threshold should trigger reassessment?

Evidence and validation

  • media inventories and chain-of-custody records
  • sanitization certificates
  • transport and storage procedures
  • removable-media control logs

Common failure patterns

  • cloud snapshots and virtual media excluded
  • sanitization method not matched to media type
  • untracked removable media
  • disposal vendors accepted without verification
Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (2)
  1. a.

    the use of the following types of system media is restricted or prohibited: [Organization-defined: types of system media].

  2. b.

    the use of removable system media without an identifiable owner is prohibited.

Examine

  • system media protection policy and procedures
  • system use policy
  • procedures for media usage restrictions
  • rules of behavior
  • system audit records
  • system design documentation
  • system configuration settings
  • system security plan
  • other relevant documents or records

Interview

  • personnel with system media use responsibilities
  • personnel with information security responsibilities
  • system administrators

Test

  • processes for media use
  • mechanisms for restricting or prohibiting the use of system media on systems or system components
Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlMP-7Open SP 800-53 control →
Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.