Mapped to NIST 800-171 Requirement: 3.8.4
CMMC Assessment Objective: MP.L2-3.8.4[a]
What This Control Means
This control ensures that only approved and properly vetted users can access media containing CUI. It focuses on:
• Assigning access permissions based on roles and responsibilities
• Maintaining documentation of who has access to what media
• Ensuring access is based on need-to-know, not convenience or default settings
The objective is to prevent unauthorized or accidental access to sensitive information.
Why It Matters
Without control over who accesses CUI on media:
• Sensitive data could be mishandled, lost, or leaked
• Insider threats may go unnoticed
• Backup tapes, USBs, or shared folders could be accessed by unauthorized personnel
• You risk audit findings or regulatory penalties for CUI exposure
Clear access control = accountability and protection.
How to Implement It
1. Define Authorized Roles
• Determine who needs access to CUI for their job
• Create role-based groups with specific privileges
2. Maintain Access Lists
• For each media type or storage location, keep a list of who has access
• Include local storage, removable media, network shares, and cloud platforms
3. Implement Least Privilege
• Only provide access to the minimum necessary media
• Regularly review access to remove unnecessary permissions
4. Link Access to Identity and Authentication Controls
• Tie access to user accounts with RBAC or ACL settings
• Require authentication and logging
5. Document and Update as Needed
• Record who is authorized
• Reevaluate during onboarding, offboarding, or job changes
Evidence the Assessor Will Look For
• Documentation listing individuals or roles authorized to access CUI media
• Access control lists for network drives, removable media, and cloud storage
• System Security Plan entries showing assigned access
• Authorization procedures or approval workflows
• Training records showing individuals are briefed on CUI responsibilities
Common Gaps
• No defined list of authorized users
• Overly broad access (e.g., “Everyone” group with CUI folder access)
• Access not updated after personnel changes
• Cloud or portable media used without tracking or approval
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Defining and documenting CUI media access roles and responsibilities
• Integrating with RBAC systems to manage and restrict access
• Maintaining auditable logs of who accessed what CUI and when
• Offering access request and approval workflows for media access
• Automatically flagging outdated or excessive access permissions
With Cuick Trac, your CUI access is known, justified, and controlled.
Final CTA
Know who can access your data—before someone who shouldn’t does.
Schedule a Cuick Trac demo to manage and document access to CUI across every media type.