This objective requires your organization to identify all forms of media—both digital and physical—that are used to store, transmit, or process Controlled Unclassified Information (CUI). This includes any medium that could carry sensitive data, whether actively in use or in storage.