NIST 800-171, a publication outlining security controls for Controlled Unclassified Information (CUI), dedicates section 3.8 to "Media Protection." This section emphasizes safeguarding CUI on all storage mediums, both digital and physical.

The first requirement focuses on securing the media itself. This includes physically controlling devices like hard drives and flash drives, as well as securely storing paper documents and microfilm. This can involve access controls for storage areas, inventory procedures, and check-in/check-out systems. Additionally, access to the CUI on this media needs to be limited. User permissions should be established to ensure only authorized individuals can view or modify the information.

Finally, when CUI-containing media reaches the end of its lifespan, secure disposal or reuse becomes crucial. NIST requires organizations to sanitize the media, meaning the CUI is permanently removed and unrecoverable. This can involve software tools or physical destruction of the media depending on the type and sensitivity of the information.