Limit access to “Controlled Unclassified Information” (CUI) on system media to authorized users.

By only allowing authorized persons access to “Controlled Unclassified Information” (CUI) you can reduce the risk of it being exposed to unauthorized persons. Limit physical access to CUI to people permitted to access CUI. Use locked or controlled storage areas and limit access to only those allowed to access CUI. Keep track of who accesses to CUI in an audit log.

Create an inventory of media (e.g., external drives) containing “Controlled Unclassified Information” (CUI). Store them in a locked container such as a file cabinet. Only provide access to the container to authorized persons. Requiring them to sign media in and out when they handle it.