MP.2.121 — Mark media with necessary CUI markings and distribution limitations

What MP.2.121 means in plain English

Any physical or digital media that contains CUI must be labeled so anyone who handles it knows it contains sensitive government information and knows who is authorized to receive it. For printed documents, this means a "CUI" header/footer on every page. For a USB drive or external hard drive containing CUI, it needs a physical label saying "CUI" and possibly the specific category and distribution limitation (like "CUI//SP-CTI" for specific Controlled Technical Information). The government provides free templates and labeling guidance — this is mostly about creating a labeling habit and applying sensitivity labels in Microsoft 365.

The assessment question

“Are all documents, files, and physical media containing CUI marked with the appropriate CUI designation and distribution/dissemination limitations — and is this marking applied consistently by all employees?”

How to implement MP.2.121

1. Download the official CUI marking templates from the National Archives CUI Registry (archives.gov/cui) — use these as your standard document headers and footers.
2. Configure Microsoft Word and Outlook templates with a pre-built CUI header/footer so employees do not have to remember to add it manually.
3. Enable Microsoft Purview sensitivity labels in Microsoft 365 (available in Business Premium) and create a "CUI" label that automatically adds a header/footer to documents and emails and restricts forwarding.
4. Purchase pre-printed CUI label stickers or a label printer for physical media (USB drives, external hard drives, printed binders) — label every piece of physical media that contains CUI.
5. Include CUI marking requirements in your annual security awareness training and add it as a checklist item in the new employee onboarding process.

Evidence your assessor will ask for

• Sample CUI-marked documents showing correct header/footer format
• Microsoft Purview sensitivity label configuration screenshot
• Photograph of CUI-labeled physical media (USB drives, binders)
• Employee acknowledgment that CUI marking requirements were covered in training

More Media Protection controls