MP.2.122 — Control access to media containing CUI during transport

What MP.2.122 means in plain English

When CUI leaves your office — whether you are carrying a laptop to a meeting, mailing a USB drive to a subcontractor, or shipping a hard drive to a customer — you must have controls to prevent unauthorized access during transit. Encryption is the most important control here (BitLocker means even if the laptop is stolen from your car, the data cannot be accessed). But you also need to track what media went where: a transport log, using trackable shipping methods, and requiring confirmation of receipt. Never email CUI unencrypted — use encrypted email or Microsoft 365's protected email feature.

The assessment question

“Is all CUI-bearing media encrypted before transport outside controlled areas — and is each transport event logged with the media description, destination, method, and confirmation of receipt?”

How to implement MP.2.122

1. Encrypt all laptops and portable drives with BitLocker before they are ever carried outside the office — this is your primary transport protection and means stolen-in-transit is not a reportable breach.
2. Create a Media Transport Log: Date, Media Description/Serial, Transport Method (hand-carry, FedEx, email), Sender, Recipient, Destination, Tracking Number if applicable, and Confirmation of Receipt date.
3. For physical media shipped by courier, use FedEx or UPS with tracking, signature-required delivery, and tamper-evident packaging — never use standard mail for CUI-bearing physical media.
4. For electronic transmission of CUI, use only encrypted channels: Microsoft 365 encrypted email, SharePoint with TLS, or a FIPS-validated file transfer tool — never plain email or FTP.
5. Define a maximum transport duration: if media does not arrive and receipt is not confirmed within 48 hours, treat it as a potential incident and initiate your incident response procedure.

Evidence your assessor will ask for

• Media Transport Log with entries for all CUI transport events
• BitLocker encryption status showing all portable devices are encrypted
• Shipping receipts or tracking records for physical media transport
• Encrypted email logs or SharePoint transfer records for electronic transmission
• CUI Transport Procedure document

More Media Protection controls