3.8.1 Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. Is a documented Media Protection policy in place that defines the physical protection and storage of all data including CDI/CUI in portable media, including paper? Is paper and digital media containing CDI/CUI physically and securely controlled and stored? Is an audit log of any media removed from these systems? Do only approved individuals have access to media from CUI systems?.