MP-1 Policy and procedures
The media protection policy and procedures control: what the MP policy must address for digital and non-digital media, who owns it, review and update cycles, and the documents assessors examine.
MP Media protection
The SP 800-53 Rev. 5 Media Protection family: access, marking, storage, transport, sanitization, use and downgrading of digital and non-digital media, with baselines, assessment procedures and evidence for each control.
MP-2 Media access
Restricting access to digital media (flash drives, tapes, external drives, optical discs) and non-digital media (paper, microfilm) to authorized personnel or roles, and how assessors verify those restrictions.
MP-3 Media marking
Marking media with distribution limitations, handling caveats and any security markings, and the exemptions allowed for media that stay inside controlled areas. Not in the low baseline.
MP-4 Media storage
Storing media securely: physically controlling and storing defined media in controlled areas and protecting it until it is destroyed or sanitized, including inventories and locked storage.
MP-5 Media transport
Protecting media in transit outside controlled areas: transport controls, accountability, documentation of transport activities and limiting transport to authorized personnel, with custodians as an enhancement.
MP-6 Media sanitization
Sanitizing media before disposal, release out of organizational control or reuse, with mechanisms strong enough for the information's security category, and the sanitization records assessors check. It is the only MP control besides MP-1 in the privacy baseline.
MP-7 Media use
Restricting or prohibiting the use of defined media types on systems or components, and prohibiting portable storage devices with no identifiable owner. Unlike MP-2, which limits who can access media, MP-7 limits which media can be used on systems.
MP-8 Media downgrading
Media downgrading: an established process for removing information from media so it can be released to recipients with lower access authorizations, using verified mechanisms. No SP 800-53B baseline includes it.
