A CMMC Assessment is being conducted at an OSC's HQ. which is a shared workspace in a multi- tenant building. The OSC is renting four offices on the…

The scenario involves handling a sensitive evidence file, which should be treated as Controlled Unclassified Information (CUI), in a physically non-secure, shared environment. The primary responsibility is to protect this information from unauthorized disclosure. Reviewing the document, making necessary notes, and then immediately destroying the physical copy via a cross-cut shredder is the only option that ensures the CUI is not left unattended or stored in an insecure location (unlocked drawer, open table) overnight. This action directly aligns with the CMMC principles of media protection, which mandate the secure handling and sanitization or destruction of media containing sensitive information when no longer needed for the immediate task.

A. Placing the document in an unlocked desk drawer in a shared conference room fails to meet the requirement to physically protect and securely store media containing CUI.

B. Creating notes on a client-provided computer introduces a new digital artifact that may not be properly secured or controlled by the assessor, creating a potential data spillage.

D. Leaving a sensitive document on a table in a shared space is a direct violation of physical and media protection controls, as it allows for potential unauthorized access.

1. NIST SP 800-171 Rev. 2

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Section 3.8.3 (MP.L2-3.8.3): "Protect system media containing CUI

both paper and digital." The discussion notes state that this includes secure storage. An unlocked drawer or an open table in a shared space does not constitute secure storage.

Section 3.8.1 (MP.L1-3.8.1): "Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse." This principle extends to CUI

and shredding is a recognized method of destruction for paper media.

2. NIST SP 800-88 Rev. 1

Guidelines for Media Sanitization.

Section 4.5

Destruction: "After the media is sanitized

it is no longer usable as originally intended... For paper

destruction can be accomplished by a variety of methods

including... shredding using a cross-cut shredder."

Table A-1

"Media/Sanitization Decision Matrix": Lists "Shred (Cross Cut)" as a valid "Destroy" technique for paper media.

3. CMMC Model Version 2.0

CMMC Practices.

Practice MP.L2-3.8.3 (from NIST SP 800-171 3.8.3): "Protect system media containing CUI

both paper and digital." This practice requires implementing physical controls to prevent unauthorized access to CUI

which options A and D fail to do. Option C fulfills this by eliminating the physical media after use.