# NIST 800-171 3.8.4 Mark media with necessary CUI markings and distribution limitations.[27]

- Source: https://support.icompaas.com/support/solutions/articles/62000229313-nist-800-171-3-8-4-mark-media-with-necessary-cui-markings-and-distribution-limitations-27-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

The term security marking refers to the application or use of human-readable security attributes. System media includes digital and non-digital media. Marking of system media reflects applicable federal laws, Executive Orders, directives, policies, and regulations. See \[NARA MARK\].  
  
\[27\] The implementation of this requirement is per marking guidance in \[32 CFR 2002\] and \[NARA CUI\]. Standard Form (SF) 902 (approximate size 2.25” x .25”) and SF 90(approximate size 2.25” x .625”) can be used on media that contains CUI such as hard drives, or USB devices. Both forms are available from https://www.gsaadvantage.gov.

  

**Priority**: Medium

  

**Category**: Asset Management 

  

**Services Associated with AWS:**   

NA

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: documented data classification scheme
-   Administrative: supporting documentation of role-based security training being performed
-   Administrative: supporting documentation to demonstrate how Data Loss Prevention (DLP) is implemented, if applicable
-   Technical: screenshot of DLP technology, if applicable 

  

Possible Technology Considerations : 

-   Data Classification Solution 

  

**What needs to be answered :**  

Are all CUI systems identified with an asset control identifier, for example, does each company laptop have an asset id tag with a unique number? Are removable system media and system output marked? 

-   Marking of System Media with CUI  
    Description: This check ensures that system media containing Controlled Unclassified Information (CUI) is appropriately marked with necessary CUI markings and distribution limitations. The marking of system media aligns with applicable federal laws, Executive Orders, directives, policies, and regulations. The purpose of marking is to provide clear identification of the security attributes associated with the media and to communicate any restrictions on its distribution. 

  

**More Details:**   

CUI is not stored on removable media.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.