Mapped to NIST 800-171 Requirement: 3.8.1
CMMC Assessment Objective: MP.L2-3.8.1[d]
What This Control Means
Once you’ve identified and documented the media types that store CUI, you must restrict who can access them. This applies to:
• Local or portable storage (e.g., USB drives, external hard drives)
• Network or cloud storage platforms
• Backup media
• Printed materials or physical files
You must ensure that access is granted based on role, need-to-know, and policy—not convenience.
Why It Matters
Without access control:
• Anyone with physical access to a device or drive could view or copy CUI
• Insider threats may go undetected
• Lost or stolen media may expose unencrypted data
• You lose visibility and accountability for how CUI is handled
This control ensures data exposure is minimized and traceable.
How to Implement It
1. Enforce Role-Based Access Controls (RBAC)
• Restrict access to digital CUI based on job role or need-to-know
• Apply file/folder-level permissions in local and cloud environments
2. Use Encryption and Authentication
• Require passwords or smart cards for access to CUI-bearing devices
• Enable encryption on portable devices and removable media (e.g., BitLocker, FileVault)
3. Control Physical Access
• Store paper records or physical drives in locked cabinets or secure rooms
• Limit who has keys or badge access to those areas
4. Audit and Monitor
• Track who accessed what, when, and from where
• Review logs regularly for unauthorized activity
5. Train Employees
• Ensure users understand CUI sensitivity and access limitations
• Make “least privilege” a cultural expectation
Evidence the Assessor Will Look For
• Access control policies tied to media and storage systems
• ACLs or RBAC configurations for systems storing CUI
• Encryption settings on laptops, drives, and cloud storage
• Logs showing access to CUI files or systems
• Documentation showing which users are authorized to access which media
Common Gaps
• No access controls on removable media or cloud folders
• Generic/shared logins used to access CUI
• Encryption disabled or inconsistently applied
• No tracking of who accesses CUI stored on media
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing access restrictions and least privilege across all CUI media
• Integrating with identity providers to control and monitor CUI access
• Ensuring encryption is applied to media containing sensitive data
• Logging user access to all enclave systems and media
• Helping document who is authorized to access each CUI-bearing system or storage medium
With Cuick Trac, CUI is locked down—and only the right people hold the keys.
Final CTA
Protecting data starts with protecting access.
Schedule a Cuick Trac demo to restrict, control, and monitor who can access CUI—wherever it lives.