Mapped to NIST 800-171 Requirement: 3.8.4
CMMC Assessment Objective: MP.L2-3.8.4[b]
What This Control Means
You’ve already identified who should have access to CUI on media (MP.L2-3.8.4[a]). Now, you must show that those authorizations are documented in:
• Access Control Policies
• System Security Plan (SSP)
• Media handling or removable device usage procedures
• Cloud storage access controls
Documentation creates visibility and helps validate that access is limited, reviewed, and appropriate.
Why It Matters
If access isn’t documented:
• You can’t prove only authorized users handle CUI
• Permissions may go unchecked or remain long after they’re needed
• Unintentional overexposure may occur
• Audit trails may be incomplete or missing
Clear records ensure CUI access is traceable and defensible.
How to Implement It
1. Update Your Policies and Plans
• Document who is authorized to access CUI-bearing media
• Use role titles or named individuals (if applicable)
2. Create a Media Access Register
• Maintain a log of authorized users for each CUI storage type:
◦ Removable media
◦ Cloud folders
◦ Backup tapes
◦ Internal file servers
3. Use Role-Based Documentation
• Assign access by job function (e.g., “Compliance Manager,” “System Admin”)
• Keep records in a centralized, version-controlled system
4. Review Access Regularly
• Confirm authorization records align with actual access permissions
• Remove users who no longer need access
5. Align With Access Control Reviews
• Tie this documentation into onboarding/offboarding and quarterly access audits
Evidence the Assessor Will Look For
• System Security Plan or Access Control Policy listing authorized CUI media users
• Role or user-specific documentation assigning access privileges
• Cloud platform or file server access control lists (ACLs)
• Change management or request forms for CUI media access
• Audit trails of access updates, approvals, or removals
Common Gaps
• No formal documentation of CUI media access permissions
• Old or unused accounts still listed as authorized
• Policies reference “authorized users” but don’t list or define them
• No access reviews to ensure documents reflect reality
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Generating and maintaining audit-ready documentation of CUI media access
• Linking users, roles, and media types in a centralized system
• Providing approval workflows for access requests and updates
• Helping reconcile documentation with real-world permissions
• Supporting role-based access enforcement aligned with written policy
With Cuick Trac, your CUI access documentation is always current, clear, and compliant.
Final CTA
If it’s not written down, it’s not compliant.
Schedule a Cuick Trac demo to centralize your CUI access documentation and close the loop on media protection.