NIST 800-171 Controls · Media Protection

MP.1.119 — Limit access to CUI on system media

CMMC Level 1SPRS if unmet: -3HIGH priority~8h to implement

Limit access to CUI on system media to authorized users.

What MP.1.119 means in plain English

Not everyone in your company needs access to every piece of CUI. The person doing accounting should not necessarily have access to the technical drawings for a defense system, and vice versa. You need to control who can access which CUI files — both digital files on the network and physical media like USBs and printed documents. On Microsoft 365 or SharePoint, this means setting folder permissions so that only the people who need a specific file can open it. For physical media, it means that locked filing cabinet key is only given to the employees who need those files.

The assessment question

“Is access to CUI on all media (digital and physical) restricted to only those employees with a documented need-to-know — with access controls technically enforced and regularly reviewed?”

How to implement MP.1.119

Create a CUI Data Map: list all locations where CUI is stored (SharePoint folders, network drives, local folders, physical binders) and for each, document who currently has access.
Apply the principle of least privilege: review the access list for each CUI storage location and remove access for any employee who does not have a documented business need for that specific CUI.
In Microsoft SharePoint or OneDrive, set folder-level permissions for CUI content — use Azure AD security groups (e.g., "CUI-Access-Group") rather than individual user assignments for easier management.
For physical media, document who holds keys to CUI storage areas and create a formal key checkout log.
Schedule a semi-annual access review to re-evaluate who has access and remove anyone whose role no longer requires it.

Evidence your assessor will ask for

CUI Data Map listing all storage locations and current authorized users
SharePoint/OneDrive permission reports for CUI folders showing restricted access
Azure AD Security Group membership list for CUI access groups
Physical media access log or key checkout record
Semi-annual access review documentation with any removed accesses noted

Does AI prompt monitoring help with this control? Honestly, no.

MP.1.119 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Media Protection controls

MP.1.118

Protect system media containing CUI

MP.1.120

Sanitize or destroy system media before disposal or reuse

MP.2.121

Mark media with necessary CUI markings and distribution limitations

MP.2.122

Control access to media containing CUI during transport

MP.2.123

Implement cryptographic mechanisms to protect CUI during transport

MP.2.124

Control use of removable media on system components

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment