Control 3.8.4

★What This Means in Plain English

Media containing CUI must be labeled to indicate that it contains controlled information and any restrictions on its distribution. This includes both digital labels and physical markings on media and documents.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• Microsoft Information Protection sensitivity labels applied to all digital CUI documents
• CUI banner markings on paper documents per 32 CFR Part 2002 requirements
• Physical labels on external storage media identifying CUI content and distribution limitations
• Email classification headers for messages containing CUI
• ComplianceArmor CUI marking guide and templates for consistent labeling

🔎Assessment Guidance

Assessors will verify that CUI media is properly marked, check that digital labeling systems are in use, review sample documents for proper CUI markings, and confirm that marking guidance is documented and personnel are trained on requirements.

⚠Common Implementation Gaps

• CUI documents without proper markings or banners
• No digital labeling system for electronic CUI
• Physical media (USB drives, disks) not labeled
• Inconsistent marking practices across the organization
• Personnel unaware of CUI marking requirements

⇄Cross-Framework Mapping