# Organizations Secure CUI Photo Transfers

The discussion outlines ways to capture and transfer photos or scans containing controlled unclassified information (CUI) into an enclave or SharePoint while limiting unnecessary expansion of the compliance boundary. It distinguishes devices that handle CUI from cameras or SD cards that may be treated as physically controlled assets, and notes that workstations used to process or transfer CUI generally need to be included in the documented environment. Examples include controlled SD-card handoff to IT, managed mobile devices uploading directly to SharePoint, and scanners or multifunction printers connected through restricted systems.

- Contractors designing or documenting CUI workflows should account for the full path from capture through transfer, including devices, removable media, workstations, access controls, and safeguards.
- The examples indicate that managed direct uploads or controlled media handoffs may support the workflow without bringing every device into scope, depending on how CUI is handled and the safeguards in place.
- Procurement teams evaluating mobile devices, scanners, or removable-media controls should assess how each option affects the documented environment and the effort required to support an assessment.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 12, 2026

### Vendors
- Apricorn ()

### Key Quotes
> point-and-shoot cameras with SD cards, marked as "may contain CUI". Removable media is disabled for non-admin users, so operator must take photos, then bring SD card to IT for copying wherever appropriate.
> — Community commenter

### Sources
- [Scanning and Photos to enclave and SharePoint](https://www.reddit.com/r/CMMC/comments/1xueomj/scanning_and_photos_to_enclave_and_sharepoint) - reddit-cmmc