MP - Media Protection
- Controls Count: 4
- Controls IDs: MP-1, MP-2, MP-6, MP-7
Controls
MP-1: Policy and Procedures
Develop, document, and disseminate to organization-defined personnel or roles:
organization-level, mission/business process-level, and/or system-level media protection policy that:
Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;
Designate an an official to manage the media protection policy and procedures is defined; to manage the development, documentation, and dissemination of the media protection policy and procedures; and
Review and update the current media protection:
Policy the frequency with which the current media protection policy is reviewed and updated is defined; and following events that would require the current media protection policy to be reviewed and updated are defined; ; and
Procedures the frequency with which the current media protection procedures are reviewed and updated is defined; and following events that would require media protection procedures to be reviewed and updated are defined;.
Media protection policy and procedures address the controls in the MP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of media protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to media protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
a media protection policy is developed and documented;
the media protection policy is disseminated to personnel or roles to whom the media protection policy is to be disseminated is/are defined;;
media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;
the media protection procedures are disseminated to personnel or roles to whom the media protection procedures are to be disseminated is/are defined;;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses purpose;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses scope;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses roles;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses responsibilities;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses management commitment;
the organization-level, mission/business process-level, and/or system-level media protection policy addresses coordination among organizational entities;
the organization-level, mission/business process-level, and/or system-level media protection policy compliance;
the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
the an official to manage the media protection policy and procedures is defined; is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.
the current media protection policy is reviewed and updated the frequency with which the current media protection policy is reviewed and updated is defined;;
the current media protection policy is reviewed and updated following events that would require the current media protection policy to be reviewed and updated are defined;;
the current media protection procedures are reviewed and updated the frequency with which the current media protection procedures are reviewed and updated is defined;;
the current media protection procedures are reviewed and updated following events that would require media protection procedures to be reviewed and updated are defined;.
Media protection policy and procedures
organizational risk management strategy
system security plan
privacy plan
other relevant documents or records
Organizational personnel with media protection responsibilities
organizational personnel with information security and privacy responsibilities
MP-2: Media Access
Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.
System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.
access to types of digital media to which access is restricted are defined; is restricted to personnel or roles authorized to access digital media is/are defined;;
access to types of non-digital media to which access is restricted are defined; is restricted to personnel or roles authorized to access non-digital media is/are defined;.
System media protection policy
procedures addressing media access restrictions
access control policy and procedures
physical and environmental protection policy and procedures
media storage facilities
access control records
system security plan
other relevant documents or records
Organizational personnel with system media protection responsibilities
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for restricting information media
mechanisms supporting and/or implementing media access restrictions
MP-6: Media Sanitization
Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures ; and
Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.
system media to be sanitized prior to disposal is defined; is sanitized using sanitization techniques and procedures to be used for sanitization prior to disposal are defined; prior to disposal;
system media to be sanitized prior to release from organizational control is defined; is sanitized using sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined; prior to release from organizational control;
system media to be sanitized prior to release for reuse is defined; is sanitized using sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined; prior to release for reuse;
sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.
System media protection policy
procedures addressing media sanitization and disposal
applicable federal standards and policies addressing media sanitization policy
media sanitization records
system audit records
system design documentation
records retention and disposition policy
records retention and disposition procedures
system configuration settings and associated documentation
system security plan
privacy plan
other relevant documents or records
Organizational personnel with media sanitization responsibilities
organizational personnel with records retention and disposition responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
Organizational processes for media sanitization
mechanisms supporting and/or implementing media sanitization
MP-7: Media Use
restrictorprohibit the use of types of system media to be restricted or prohibited from use on systems or system components are defined; on systems or system components on which the use of specific types of system media to be restricted or prohibited are defined; using controls to restrict or prohibit the use of specific types of system media on systems or system components are defined; ; and
Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
System media includes both digital and non-digital media. Digital media includes diskettes, magnetic tapes, flash drives, compact discs, digital versatile discs, and removable hard disk drives. Non-digital media includes paper and microfilm. Media use protections also apply to mobile devices with information storage capabilities. In contrast to MP-2 , which restricts user access to media, MP-7 restricts the use of certain types of media on systems, for example, restricting or prohibiting the use of flash drives or external hard disk drives. Organizations use technical and nontechnical controls to restrict the use of system media. Organizations may restrict the use of portable storage devices, for example, by using physical cages on workstations to prohibit access to certain external ports or disabling or removing the ability to insert, read, or write to such devices. Organizations may also limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Finally, organizations may restrict the use of portable storage devices based on the type of device, such as by prohibiting the use of writeable, portable storage devices and implementing this restriction by disabling or removing the capability to write to such devices. Requiring identifiable owners for storage devices reduces the risk of using such devices by allowing organizations to assign responsibility for addressing known vulnerabilities in the devices.
the use of types of system media to be restricted or prohibited from use on systems or system components are defined; is restrictorprohibit on systems or system components on which the use of specific types of system media to be restricted or prohibited are defined; using controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;;
the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.
System media protection policy
system use policy
procedures addressing media usage restrictions
rules of behavior
system design documentation
system configuration settings and associated documentation
audit records
system security plan
other relevant documents or records
Organizational personnel with system media use responsibilities
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for media use
mechanisms restricting or prohibiting the use of system media on systems or system components