NIST 800-171 Controls · Media Protection

MP.2.122 — Control access to media containing CUI during transport

CMMC Level 2SPRS if unmet: -1MEDIUM priority~3h to implement

Control access to media containing CUI during transport outside of controlled areas and maintain accountability for media during transport.

What MP.2.122 means in plain English

When CUI leaves your office — whether you are carrying a laptop to a meeting, mailing a USB drive to a subcontractor, or shipping a hard drive to a customer — you must have controls to prevent unauthorized access during transit. Encryption is the most important control here (BitLocker means even if the laptop is stolen from your car, the data cannot be accessed). But you also need to track what media went where: a transport log, using trackable shipping methods, and requiring confirmation of receipt. Never email CUI unencrypted — use encrypted email or Microsoft 365's protected email feature.

The assessment question

“Is all CUI-bearing media encrypted before transport outside controlled areas — and is each transport event logged with the media description, destination, method, and confirmation of receipt?”

How to implement MP.2.122

Encrypt all laptops and portable drives with BitLocker before they are ever carried outside the office — this is your primary transport protection and means stolen-in-transit is not a reportable breach.
Create a Media Transport Log: Date, Media Description/Serial, Transport Method (hand-carry, FedEx, email), Sender, Recipient, Destination, Tracking Number if applicable, and Confirmation of Receipt date.
For physical media shipped by courier, use FedEx or UPS with tracking, signature-required delivery, and tamper-evident packaging — never use standard mail for CUI-bearing physical media.
For electronic transmission of CUI, use only encrypted channels: Microsoft 365 encrypted email, SharePoint with TLS, or a FIPS-validated file transfer tool — never plain email or FTP.
Define a maximum transport duration: if media does not arrive and receipt is not confirmed within 48 hours, treat it as a potential incident and initiate your incident response procedure.

Evidence your assessor will ask for

Media Transport Log with entries for all CUI transport events
BitLocker encryption status showing all portable devices are encrypted
Shipping receipts or tracking records for physical media transport
Encrypted email logs or SharePoint transfer records for electronic transmission
CUI Transport Procedure document

Does AI prompt monitoring help with this control? Honestly, no.

MP.2.122 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Media Protection controls

MP.1.118

Protect system media containing CUI

MP.1.119

Limit access to CUI on system media

MP.1.120

Sanitize or destroy system media before disposal or reuse

MP.2.121

Mark media with necessary CUI markings and distribution limitations

MP.2.123

Implement cryptographic mechanisms to protect CUI during transport

MP.2.124

Control use of removable media on system components

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment