How should removable media containing CUI be controlled?

• A. Encrypt, limit access, inventory, and ensure sanitization or destruction before disposal or reuse.
• B. Leave removable media unencrypted but require a login prompt.
• C. Store media in an insecure location but label it.
• D. Allow reuse without sanitization.

Answer: (A)

Protecting CUI on removable media requires a layered set of controls that address data at rest, access, accountability, and disposal. Encrypting the data on the media ensures that even if the device is lost or stolen, the information cannot be read without the proper cryptographic key. Limiting access restricts who can use the media, reducing the chance of exposure from unauthorized or careless handling. Maintaining a current inventory of removable media helps you track where CUI is stored and confirms that each item is accounted for. Sanitization or destruction before disposal or reuse ensures that any residual data cannot be recovered, preventing leakage when the media leaves service.

These elements work together to reduce risk at every stage—during use, when the media is misplaced, and when it is disposed of or repurposed. The other options fail to provide comprehensive protection: leaving media unencrypted, even with a login prompt, leaves data readable if the media falls into the wrong hands; storing labeled but insecurely held media does not prevent access; and allowing reuse without sanitization risks residual data being recovered.