“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.8.1 Lock up paper and drives
Physically protect anything that holds DoD shipment information, paper or digital: DD forms, printed bills of lading, inventories, USB drives and backup disks are kept in locked drawers, cabinets or rooms.
Usually applies to: Orders, inventories, bills of lading and other printouts, plus USB drives, backup disks and old hard drives, wherever they are kept: office, dispatch desk, warehouse office and trucks.
3 points if not met Cannot wait on a POA&M
Official wording: “Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.”
3.8.2 Only approved people handle them
Only authorized people can get to that paperwork and those drives.
Usually applies to: The same paperwork and drives, and the cabinets, drawers and rooms that hold them.
3 points if not met Cannot wait on a POA&M
Official wording: “Limit access to CUI on system media to authorized users.”
3.8.3 Shred and wipe before disposal
Shred paper and wipe or destroy drives that held DoD shipment information before they are thrown out or reused, including old computers and the hard drives inside copiers.
Usually applies to: Old paperwork, retired computers, phones and tablets, USB drives, and the hard drives inside copiers and printers.
5 points if not met Cannot wait on a POA&M
Official wording: “Sanitize or destroy system media containing CUI before disposal or release for reuse.”
3.8.4 Mark CUI
Mark documents and drives that contain CUI with the required CUI markings, and any limits on who may receive them.
Usually applies to: Paperwork and drives that contain CUI, including what you print or create from DoD shipment information.
1 point if not met May wait on a POA&M
Official wording: “Mark media with necessary CUI markings and distribution limitations.”
3.8.5 Keep track of it on the road
When paperwork or drives with DoD shipment information leave the office, for example paperwork riding in a truck, keep them under control and know where they are.
Usually applies to: Paperwork and drives that leave the office: in trucks, at the residence, at the warehouse or with an agent.
1 point if not met May wait on a POA&M
Official wording: “Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.”
3.8.6 Encrypt drives that travel
Encrypt USB drives and laptops that carry DoD shipment information outside the office, unless they are protected some other physical way.
Usually applies to: USB drives and laptops that leave the office with DoD shipment information on them.
1 point if not met May wait on a POA&M
Official wording: “Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.”
3.8.7 Control USB drives
Control the use of USB drives and other removable media on your computers, and block them where they are not needed.
Usually applies to: USB ports and card slots on office computers and laptops, and the drives, memory cards and phones plugged into them.
5 points if not met Cannot wait on a POA&M
Official wording: “Control the use of removable media on system components.”
3.8.8 No unknown USB drives
Never use a USB drive with no known owner, such as one found in the parking lot or left in a truck.
Usually applies to: Any USB drive or memory card with no known owner.
3 points if not met Cannot wait on a POA&M
Official wording: “Prohibit the use of portable storage devices when such devices have no identifiable owner.”
3.8.9 Protect backups
Backups that contain DoD shipment information are protected, encrypted or locked away, wherever they are stored.
Usually applies to: Backups of your moving software, email, computers and shared drives, wherever they are kept, including cloud backup services.
1 point if not met May wait on a POA&M
Official wording: “Protect the confidentiality of backup CUI at storage locations.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
