How should portable media containing CUI be safeguarded?

• A. Portable media containing CUI should be encrypted and access-controlled.
• B. Portable media containing CUI should be encrypted, access-controlled, and used only by authorized personnel; minimize use when possible.
• C. Portable media containing CUI can be kept unencrypted if stored in a locked drawer.
• D. Portable media containing CUI should be encrypted, but access controls are not required.

Answer: (B)

Protecting CUI on portable media relies on keeping the data confidential even if the device is lost or stolen. Encryption is essential because it renders the data unreadable without the proper keys, so the material remains protected regardless of where the media ends up. Adding access controls ensures that only people who have verified credentials and explicit permission can access or use the data, closing the gap that encryption alone can’t fill. Requiring that the media be used only by authorized personnel enforces need-to-know and accountability, making sure access is deliberate and traceable. Minimizing use further reduces exposure by limiting how broadly the media is circulated and how long it remains in play. Keeping unencrypted media in a locked drawer may seem safer, but physical security alone isn’t enough—someone could access or remove the media, and without encryption, the data would be exposed. Encryption without access controls leaves a risk if the device falls into the wrong hands, and access controls without restricting to authorized users can broaden exposure. Combining encryption, access controls, and authorized usage, with an emphasis on minimizing use, provides the strongest protection for CUI on portable media.