A USB drive from the vendor. A recovery disk brought in by IT. A backup tape being restored. These items enter your environment during maintenance. If they’re compromised, they introduce malware to your systems. Scan them. Document it. Simple.
What the assessor is actually evaluating
The assessor checks: (1) Do you have a procedure that says media gets scanned? (2) Do you actually do it? (3) Can you show recent examples? You don’t need a sophisticated scanning protocol. Antivirus scanning is acceptable. What you need is a consistent practice and documentation.
Focus on media used for or brought into maintenance. External drives, backup media, recovery disks, vendor-supplied software. If it could introduce files to your systems, it should be scanned. Media inspection complements MA.L2-3.7.2 (maintenance tools) and links to broader media protection requirements under MP.L2-3.8.1.
What a realistic SSP definition looks like
All media brought into [Company] for maintenance or system operations is scanned for malicious code using [antivirus tool] before use on CUI systems. Media includes external drives, USB devices, backup tapes, recovery disks, and vendor-supplied media.
Scans are performed and documented in the maintenance log. Media is scanned on an isolated system or with tools configured to quarantine threats. Results are recorded by date and media identifier.
Vendor media arriving with certification of cleanliness may be used without re-scanning if the certificate is recent (within [30] days).
How to present your evidence
- Media inspection procedure (what media, when to scan, what tools, documentation)
- Recent maintenance logs or work orders showing media used and scanned
- Antivirus scan reports or logs from media scans (include dates and results)
- List of approved media or media inventory
- If applicable, vendor certifications stating media is malware-free
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Q: “Can you show me an example?" A: “[Date], we received a recovery disk from the vendor. We scanned it, it came back clean, and we used it for [system] recovery.”
Q: “What if a scan finds malware?" A: “We don’t use it. The media is quarantined and reported. We request clean media from the vendor.”
Common failures
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
Practical implementation
Create a simple media inspection checklist or log:
- Media identifier (media name, vendor, date received)
- Scan date and tool used
- Scan result (clean, threat detected, etc.)
- Approval or quarantine decision
For most organizations, plugging media into an antivirus-protected PC and running a full scan is sufficient. Document it.
Vendor media often comes with “certified clean” statements. You can accept these without re-scanning if they’re recent.
For high-risk media (external drives, recovery media), always scan.
If you use an MSP/MSSP
This guide reflects CMMC Level 2 requirements as of March 2026. CMMC and NIST standards evolve. Verify current requirements with official CMMC materials and your assessor.