Assessors often find broad sharing permissions, removable media that is only restricted by policy, unverified endpoint encryption, weak backup governance, and missing sanitization records. The recurring issue is a gap between declared controls and the actual places where CUI still exists.
Where CMMC media protection failures usually show up
The most common media protection failures are usually not exotic technical gaps. They are control gaps where policy exists, but the assessor cannot verify that media is actually restricted, encrypted, tracked, or sanitized in the way the organisation claims. That gap often appears across removable media, backups, endpoints, and retained storage copies of CUI.
Assessors are looking for whether media handling is operationally real, not just documented. If the environment still allows broad access, uncontrolled transfer, or undocumented retention, the assessment problem is usually consistency and evidence, not the absence of a written rule.
One practical way to think about this is that media protection fails when teams protect the “named” repository but miss the live copies, local caches, backup sets, exports, and portable devices where CUI continues to exist.
Why removable media, backups, and endpoint storage are the usual weak points
Removable media is commonly weak because it depends on user behaviour and local enforcement. A policy that says USB storage is restricted does not prove that devices are blocked, logged, approved, or encrypted. Similar issues show up in backup systems when teams can describe retention and recovery, but cannot show who can access the backup copies, how those copies are protected, or whether the restore process preserves the same safeguards.
Endpoint storage is another frequent failure point because encryption may be assumed rather than verified. If a laptop, desktop, or portable device is claimed to be encrypted, the assessor will often look for proof that encryption is enabled, centrally managed, and enforced on every relevant device, including any exceptions. Missing or stale evidence here creates the impression that the control is aspirational rather than dependable.
For backup and recovery media, the critical question is whether the organisation can limit access to the backup set itself and still recover data when needed. That makes backup governance part of media protection, not just resilience planning.
What recordkeeping and sanitization gaps tell an assessor
Missing sanitization records are a strong signal that media disposition is not being managed consistently. If drives, tapes, portable devices, or retired systems leave service without a traceable sanitization method, the assessor cannot verify that CUI was removed before reuse, transfer, or disposal. That is why sanitization is not only about the act of wiping or destroying media, but also about proving the act happened in a controlled way.
When records are incomplete, the issue is often the same as with access controls: the process may exist, but there is no reliable evidence chain. If the organisation cannot show what was sanitized, when, by whom, and by what method, the control will usually be treated as weak even if staff believe the process is followed.
Assessors also pay attention to whether media inventories match reality. If an asset list does not reflect the devices, backups, exports, or removable storage actually in use, the organisation may be protecting the wrong set of objects while untracked media remains outside the control boundary.
Risk and Threat Considerations
The risk is that CUI remains exposed in locations the organisation does not actively control, especially on removable media, backup copies, and endpoints. That creates both compliance failure and real confidentiality exposure, because a control that is only declared but not enforced gives a false sense of containment.
Failure mechanism: broad permissions, unverified encryption, weak backup governance, and missing sanitization evidence allow CUI to persist on media that can be copied, lost, reused, or recovered outside the intended control boundary.
Impact: the organisation can fail a CMMC assessment, lose confidence in its media handling controls, and increase the chance that sensitive data survives longer than intended on devices or copies that were assumed to be protected.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | MP-6 — Media Sanitization | CMMC media failures often hinge on whether media is sanitized and evidenced correctly. |
| MP-4 — Media Storage | Broad sharing, removable media, and backup governance are media storage protection problems. | |
| SC-28 — Protection of Information at Rest | Endpoint encryption verification and retained copies are data-at-rest protection issues. | |
| Recommendation — Verify and document sanitization methods for media that held CUI before reuse or disposal. Restrict and monitor where CUI media is stored, including backups and portable devices. Enforce protection for CUI at rest on endpoints, backup media, and retained copies. | ||
| CIS Controls v8 | CIS-3 — Data Protection | CMMC media protection failures are directly addressed by controls for protecting sensitive data on media. |
| Recommendation — Apply data protection safeguards to removable media, backups, endpoints, and sanitized assets. | ||
Practitioner Guidance
What to verify: confirm that every media class with possible CUI exposure has both a control rule and proof of enforcement. That means checking actual device restrictions, encryption status, backup access paths, and sanitization evidence rather than relying on policy statements or tool defaults.
Common mistake: treating backup platforms and endpoint encryption as infrastructure details instead of media protection evidence. If you cannot trace where CUI is stored, copied, and retired, the assessment gap is usually in scope definition and evidence collection, not just in technology configuration.
Practitioner takeaway: the strongest assessments come from proving that media controls work where CUI actually lives, moves, and expires, not from showing that a policy exists for the right category of media.