NIST 800-171 Controls · Media Protection

MP.1.118 — Protect system media containing CUI

CMMC Level 1SPRS if unmet: -3HIGH priority~6h to implement

Protect (i.e., physically control and securely store) information system media containing CUI, both paper and digital.

What MP.1.118 means in plain English

Any physical item that contains your government contract information must be stored securely. This includes laptops, USB drives, printed documents, CDs, backup drives, and even paper notes that have CUI written on them. "Securely stored" means locked cabinets or offices when not in use, encrypted hard drives on laptops, and not leaving sensitive printouts on desks overnight. For your 8-person team: lock paper files in a filing cabinet, encrypt all laptop hard drives with BitLocker, keep backup drives in a locked drawer, and shred sensitive documents rather than tossing them in recycling.

The assessment question

“Is all media containing CUI (both digital and paper) physically secured when not in use — with digital media encrypted and paper media stored in locked containers?”

How to implement MP.1.118

Enable BitLocker full-disk encryption on every company laptop, workstation, and external hard drive that contains or may contain CUI — store the BitLocker recovery keys in Azure AD or a secured password manager vault.
Purchase a locking filing cabinet for all paper documents containing CUI — keep it locked when not actively in use, with the key held only by authorized personnel.
Purchase a cross-cut shredder (Level P-4 or higher, approximately $60-$120) for destroying paper CUI — place it near the printer so there is no excuse to use the recycling bin.
Create a "Clean Desk Policy": no CUI documents left on desks overnight, laptops locked or stored securely after business hours.
Conduct a quarterly Media Inventory to account for all CUI-bearing media: list each device, its location, its encryption status, and its custodian.

Evidence your assessor will ask for

BitLocker encryption status report for all company devices
Azure AD BitLocker recovery key escrow screenshot
Photograph of locked filing cabinet used for paper CUI storage
Written Clean Desk Policy distributed to all employees
Media Inventory showing all CUI-bearing media, locations, and encryption status

Does AI prompt monitoring help with this control? Honestly, no.

MP.1.118 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Media Protection controls

MP.1.119

Limit access to CUI on system media

MP.1.120

Sanitize or destroy system media before disposal or reuse

MP.2.121

Mark media with necessary CUI markings and distribution limitations

MP.2.122

Control access to media containing CUI during transport

MP.2.123

Implement cryptographic mechanisms to protect CUI during transport

MP.2.124

Control use of removable media on system components

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment