3.8.1 has a weight of -3 points

Control: SP 800-171 Control 3.8.1 – Physically Control and Securely Store System Media Containing CUI

Control Description: System media containing CUI, in both paper and digital forms, should be physically controlled and securely stored. It entails being aware of its location, ensuring it isn’t taken out of secure areas without proper authorization, and storing it in a secured environment.

Implementation:

1. Physical Security of CUI:

   • Our building has a designated area explicitly used for CUI. This area is always controlled, locked, and monitored. Access is granted using keycards, ensuring only authorized personnel can enter. Additionally, the area is under constant video surveillance to maintain the integrity and security of the data stored.
   • The CUI designated area, is locked, acts as a primary perimeter, ensuring CUI isn’t accessible by unauthorized personnel.
   • Any CUI data not stored within the designated area is stored and protected in a FedRAMP  compliant data centers.

2. Digital Security of CUI:

   • Our policy strictly prohibits storing CUI on any form of digital media outside the GCC High environment.
   • Only designated and authorized personnel with a clear need to know, have the authority to store CUI on the GCC environment.
   • Folder and data access within the GCC environment is meticulously managed. Permissions are set to ensure that only authorized users can view and interact with specific pieces of information.
   • Every CUI in transit, whether digitally or physically, is protected either by encryption or by physical safeguards appropriate to the mode of transportation.

3. Paper Copies of CUI:

   • We strictly avoid maintaining paper versions of CUI, with the rare exception of certain items, which are securely stored in the classified safe inside a secure area of the building.

4. Training:

   • All authorized staff members, without exception, must complete the DoD CUI training. This training equips personnel with the knowledge and understanding needed to handle and protect CUI effectively.

POA&M for SP 800-171 Control 3.8.1

Control: SP 800-171 Control 3.8.1 – Physically Control and Securely Store System Media Containing CUI

Control Description: System media containing CUI, in both paper and digital forms, should be physically controlled and securely stored.

Milestones:

1. Establish a Secure CUI Containment Area:

   • Task: Identify and designate a specific area within the building for CUI containment.
   • Completion Date: [specific date]
   • Responsible Party: Facilities Management / Security Team
   • Status: Not Started / In Progress / Completed
   • Notes: N/A

2. Install Physical Security Measures:

   • Task: Implement keycard access and video surveillance in the designated CUI area.
   • Completion Date: [specific date]
   • Responsible Party: Facilities Management / Security Team
   • Status: Not Started / In Progress / Completed
   • Notes: Consider integrating access logs to monitor and audit entry and exit events.

3. Research Digital Storage Solutions for CUI:

   • Task: Evaluate software solutions like Google Assured, Microsoft GCC High, and Prevail for secure CUI storage.
   • Completion Date: [specific date]
   • Responsible Party: IT Management / Security Team
   • Status: Not Started / In Progress / Completed
   • Notes: Consider evaluating factors such as compatibility, scalability, and ease of migration.

4. Acquire and Implement Digital Storage Solution:

   • Task: Procure the selected digital storage solution and begin implementation.
   • Completion Date: [specific date]
   • Responsible Party: IT Management / Security Team
   • Status: Not Started / In Progress / Completed
   • Notes: Ensure the solution meets FedRAMP compliance.

5. Ensure Training Compliance:

   • Task: Schedule and track DoD CUI training for all authorized staff members.
   • Completion Date: [specific date]
   • Responsible Party: HR / Training Department
   • Status: Not Started / In Progress / Completed
   • Notes: Consider establishing annual refresher courses to keep staff updated on best practices.

Monitoring and Reporting:

• Frequency: Monthly review meetings will be held to assess progress on the milestones.
• Reporting: Updates will be documented and reported to senior management to ensure alignment and resource allocation.
• Audit: An annual internal audit will be conducted to ensure continued compliance and effectiveness of the control.