MP-1 Policy and procedures: requirements and evidence

What MP-1 policy and procedures asks an organization to prove

MP-1 asks an organization to maintain a media protection policy and the procedures that implement it, covering both digital media (such as flash drives, tapes and external drives) and non-digital media (such as paper and microfilm). The policy must be set at the organization, mission or business process, or system level, name the roles responsible for it, be disseminated to those roles, be owned by a designated official, and be reviewed and updated on a defined schedule and after defined events. An assessor will not accept a policy that exists only as a document; they will check that people who handle media know it and that it is kept current.

The risk MP-1 addresses is inconsistent handling of media across teams. When engineering, facilities, legal and records staff each treat backup tapes, printed reports or USB drives differently, protections for one team quietly fail at another team's hand-off. The control is hard in practice because policies are often written once, approved and filed, then never tied to the controls that do the work: MP-2 (access), MP-3 (marking), MP-4 (storage), MP-5 (transport), MP-6 (sanitization), MP-7 (use) and MP-8 (downgrading). Each of those controls should trace back to a clause in the policy and a step in a procedure, so that a gap in one shows up in the other.

Before a policy is drafted, confirm with your assessor or baseline owner which media types are in scope, which systems and facilities hold them, and who holds the designated official role. The NIST control catalog entry for MP-01 in the CPRT catalog lists the expected components. For evidence, keep the approved policy, the procedures, dissemination records, review history showing dates and approvers, and proof that review was triggered by any defined events. Version-controlled wikis such as XWiki record who changed what and when, which helps demonstrate that review actually happened, though the organization must still define the review frequency itself.

Which systems, teams and baselines does MP-1 apply to

MP-1 is allocated to the low, moderate and high baselines and to the privacy baseline, so it applies to almost every system that falls under SP 800-53B. The cards below cover the decisions that determine how far the policy reaches and what an assessor will expect to see scoped in.

Baseline allocation across impact levels

SP 800-53B allocates MP-1 to the low, moderate and high baselines, so a policy is required regardless of impact level. The control is not optional for a low-impact system. Confirm which baseline each system was categorized under, because that determines whether MP-1 is in the control set. Record the selected baseline and any tailoring decisions in the system security and privacy plan so the assessor can trace the requirement to a specific system.

Organization, mission or system level

The policy may be set at the organization, mission or business process, or system level. Decide which level fits your structure and document it, because an assessor will ask who the policy covers. A single organization-wide policy with procedures per system is a common pattern, but a mission-specific policy may be needed where media handling differs materially. Confirm that whichever level you choose reaches every system in the authorization boundary.

Digital and non-digital media in scope

The policy must address both digital media, such as flash drives, tapes, external drives and optical discs, and non-digital media, such as paper and microfilm. Many programs write the policy for electronic media and forget printed records or removable paper archives. Inventory every media type that holds system information, including backup tapes and printouts from reporting tools, and confirm each type is named in the policy scope.

Owners of media handling

Media handling usually spans IT operations, facilities, records management, backup administration and the business units that generate printed output. The policy needs a designated official who manages it, and procedures need named owners in each team. Confirm who receives the policy, who signs off on changes and who answers for media that leaves a controlled area. Unclear ownership is one of the most common gaps assessors find under MP-1.

Third-party custodians and hosting providers

When a cloud provider, colocation facility or offsite storage vendor holds media or backups, the policy still applies to your information. Decide whether the policy governs the provider directly, through contract terms, or through a shared responsibility document, and record that split. Confirm that your hosting and custodian agreements reference media protection obligations and that you can obtain the provider's own media handling evidence when an assessor asks.

Privacy baseline changes the scope

The privacy baseline applies MP-1 to systems that process PII, regardless of impact level, and MP-1 is one of only two MP controls in that baseline alongside MP-6. A system processing PII therefore needs a policy that addresses media containing personal information, even if its security categorization is low. Confirm whether any system handles PII, identify where that data sits on media, and make sure the policy's procedures reflect those locations.

What the MP policy must address before any media control works

MP-1 asks the organization to write a media protection policy and the procedures that put it into practice, and an assessor will not accept MP-2 through MP-8 as working controls until this foundation exists. The policy must cover purpose, scope, roles and responsibilities, management commitment, coordination among organizational entities, and compliance. Purpose and scope tell the reader which media and which systems are covered. Roles and responsibilities name who handles media at each stage. Management commitment shows that leadership has approved the policy. Coordination describes how facilities, IT, records, legal and the security function share work on media. Compliance states how adherence is checked and what happens when it fails. Each element should appear as a visible heading or clause in the document, because an assessor will read the policy looking for them one by one. The policy must name digital and non-digital media explicitly. A policy that speaks only of "data storage devices" leaves paper, microfilm and printed reports outside its reach, and the assessor will check that both categories are named in scope. Name the media types your environment actually uses, such as USB drives, backup tapes, external drives, optical discs, printed records and microfilm, and point to the MP controls that govern each one. Scope should also state the classification level or security category the policy applies to, since MP-6 and MP-4 decisions depend on it. Procedures are the operational layer. Where the policy states intent, the procedures tell staff how to carry out each MP control: how media is restricted, labeled, stored, transported, sanitized and used. Each procedure should name the role that performs the step, the record it produces and the system where that record lives. Confirm with your own assessors whether they expect one procedure per MP control or a combined document, and confirm where your environment keeps the approved versions and their change history.

Assign one designated official to own both the policy and the procedures. This person approves changes, keeps the distribution list current, and answers assessor questions about who reviewed what and when. Ownership must be explicit in the document itself, not implied by the department that happens to store it. Set the review frequency and the triggering events in the policy, such as a change in regulatory obligations, a significant incident involving media, the introduction of a new media type, or a reorganization that moves responsibilities. Confirm the review interval with your governance board and with the baseline you are being assessed against, and record each review date and outcome. Whatever cycle you choose, the evidence an assessor will request is the dated version history, the approval record and proof that the current version was disseminated to the defined roles.

How an assessor tests MP-1 under SP 800-53A

This table compares the examine and interview work an assessor performs for MP-1, with the evidence requested and the findings that commonly appear. Read each row as one assessment focus: the examine rows show what documents are reviewed, and the interview rows show whom the assessor questions to confirm the policy is understood and operated. SP 800-53A Rev. 5 sets 17 determination statements for MP-1, so a gap in any one row can leave the control unsatisfied.

Assessment focus	Evidence requested	Common findings
Examine: policy content	Media protection policy covering purpose, scope, roles, responsibilities, management commitment, coordination and compliance, for digital and non-digital media	Policy omits non-digital media such as paper or microfilm, or lacks a stated scope at the organization, mission or system level
Examine: procedures	Procedures that implement the policy for each MP control, with owners and steps	Procedures contradict the policy, for example a shorter retention or a different approval path than the policy states
Examine: risk management strategy	Organizational risk management strategy showing how media protection risk is set and accepted	Policy is written in isolation and does not trace to the organization's stated risk tolerance
Examine: dissemination	Distribution records, access logs or acknowledgments showing the policy and procedures reached defined roles	Policy exists but is not disseminated, or sits in a repository only a few staff can reach
Examine: designated official	Document naming the official who manages the policy and procedures, with a current appointment	Ownership is unassigned, or the named official has left the role and no successor is recorded
Examine: review and update	Revision history, review dates and records of updates after defined events	Review frequency is defined but not performed, or no update follows a significant change or incident
Interview: personnel with media protection responsibilities	Staff describe their duties, the policy they follow and where they find the procedures	Staff are unaware the policy exists or describe practices that differ from the written procedures
Interview: management and designated official	Confirmation of management commitment, review decisions and how exceptions are approved	Managers cannot describe how the policy was reviewed or who approves deviations

How to build the MP-1 policy and procedures in order

This sequence turns MP-1 into a working policy set: it fixes which systems and baselines are in scope, inventories the media they handle, assigns ownership, and ends with disseminated, reviewed documents that assessors can trace to each media protection control.

Confirm applicable baselines and systems
Start by establishing which systems fall under the low, moderate or high baseline, or the privacy baseline, because SP 800-53B allocates MP-1 to each of these. The compliance lead and system owners review the system security categorization and the authorization boundary, then record which systems and business processes the policy must cover. The output is a scope statement that names each in-scope system, its impact level and the baseline that applies. If the organization tailors the baseline, the tailoring decisions should be recorded here so the policy does not claim coverage it does not provide.
Inventory digital and non-digital media
Work with system owners, facilities staff and records managers to list every media type that holds information within scope. Digital media includes items such as flash drives, external drives, tapes and optical discs, while non-digital media includes paper and microfilm. For each type, record who uses it, where it is kept, what information it carries and whether it leaves controlled areas. The output is a media inventory that the policy can reference, and it becomes the input for the MP-2 through MP-8 procedures.
Agree the policy level and designated official
Decide whether the policy is set at the organization, mission or business process, or system level, and document why. Then name the designated official who manages the policy and procedures, along with the roles responsible for media protection in each business area. Senior management should formally commit to the policy, since MP-1 expects a statement of management commitment. The output is a short decision record stating the policy level, the official's name and title, and the roles with responsibilities, approved by the accountable executive.
Draft the policy and procedures
Write the media protection policy so it covers purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities and compliance. Address both digital and non-digital media explicitly. Then write procedures that show how staff implement the policy day to day. Map each required element to a section of the document so an assessor can trace it quickly. Compliance and security engineering should review the draft together. The output is a draft policy and a procedures document, each with an owner, a version number and a traceability table.
Disseminate and record acknowledgment
Share the approved policy and procedures with the defined roles and keep proof that they received them. The designated official should distribute the documents through the organization's controlled document repository, where access and version history are recorded. Staff in the defined roles should acknowledge receipt, and the acknowledgment list should be retained with the document. Wiki or document platforms with version control and role-based permissions can hold these records, but the organization must confirm that the chosen tool keeps the audit trail assessors will request. The output is an approved policy version and a dissemination record listing recipients, dates and acknowledgments.
Set the review cycle and triggering events
MP-1 requires a defined review and update frequency and a list of events that prompt an earlier review. Set the frequency based on the organization's own risk appetite and any contractual or regulatory obligations, and document it in the policy. Typical triggers include changes to the authorization boundary, new media types, a security incident involving media, and changes in applicable law. The output is a review calendar and a change log template, with the designated official named as the owner of each review.
Link procedures to MP-2 through MP-8
Connect the MP-1 documents to the operational controls that carry out media protection: access restriction (MP-2), marking (MP-3), storage (MP-4), transport (MP-5), sanitization (MP-6), media use (MP-7) and downgrading (MP-8) where it applies. For each control, name the procedure that implements it, the owner, and the evidence it produces, such as sanitization records or transport logs. Confirm which of these controls the chosen baseline requires, since MP-3 is not in the low baseline and MP-8 is in no SP 800-53B baseline. The output is a cross-reference matrix that lets an assessor move from the policy to each implementing procedure and its evidence.

Which evidence passes an MP-1 assessment

An assessor testing MP-1 looks for a small set of documents that show the media protection policy exists, was approved, reached the right people, is reviewed on schedule and changes when events require it. Each card below covers one artifact and how to keep it current between assessments, so the evidence reflects the organization's actual practice on the day it is examined.

Approved media protection policy

The policy is the core artifact. It should state its purpose, scope, roles, responsibilities, management commitment, coordination and compliance, and it should address both digital and non-digital media. Keep a version number on the document and an approval record showing who signed it and when. Between audits, confirm the policy still names the current owner and the current systems and media types in scope, and that the version in the document control system matches the approved copy. Illustrative: a policy approved under a former CISO that still names a retired ticketing system signals stale content.

Media protection procedures document

Procedures describe how the policy is carried out day to day: how media is handled, who performs each step and what records are created. Assessors compare procedures against the policy to see whether each policy statement has a matching operational step. Keep procedures tied to the systems and media types the organization actually uses, and record the owner and review date on each procedure. Confirm that the steps still match current tools, since out-of-date procedures are a common finding when systems change.

Dissemination record by role

Dissemination shows that the policy and procedures reached the defined roles, not just a shared drive. Keep a distribution list or acknowledgment log that names each role, the document version it received and the date. Update it whenever a role is added, a person changes position or a new version is published. Confirm that acknowledgments cover personnel who handle media, such as storage custodians and transport staff, because an assessor may ask those people what they were told to do.

Designated official appointment

MP-1 requires the policy to be managed by a designated official. The appointment record should name the person or role, state the responsibilities assigned, and show the date and approving authority. Keep the record current when the individual leaves or the role is reorganized. Confirm that the official has the authority and time to review the policy, and that the appointment letter or governance minute is retrievable without asking the person who wrote it.

Review records against the defined frequency

The organization sets a review and update frequency for the policy and procedures, and MP-1 expects that cycle to be followed. Keep a dated review log that records who reviewed each document, what was checked and whether changes were made, even when the answer is no change. Calendar the next review from the defined frequency and track it in the same system that holds the policy. Confirm the frequency you defined is the one you actually run; an assessor will compare the two.

Change log for event-driven updates

MP-1 also requires updates after defined events, such as a security incident involving media, a significant system change, or a change in law or organizational structure. Keep a change log that records each event, the trigger that applies, the revision made and its approval. Use a document platform that keeps version history, so the change log and the document history point to the same changes. Confirm that every defined trigger has a documented path to a review, even in periods with no triggering event.

What meeting MP-1 costs in money and effort

This table breaks down the cost and effort components of meeting MP-1 Policy and procedures, showing who is paid, whether each cost is one-time or recurring, what drives it, and how to keep it down. No figures are supplied for these components, so use the table to structure your internal estimate and your written quote requests.

Cost component	One-time or recurring	What drives it	How to keep it down
Internal policy drafting time	One-time, then recurring on revision	Number of media types in scope, number of system levels the policy covers, and how many functions must agree on wording	Start from the MP-1 determination statements in SP 800-53A and draft one policy for digital and non-digital media rather than separate documents
Legal or privacy review	Recurring with each revision	Whether media contain personal data, sector rules, and whether counsel must review disposal or transfer language	Ask reviewers to comment on a defined draft and agree in advance which changes need their sign-off
Media inventory	One-time build, then recurring upkeep	Number of media types, locations, custodians and systems that hold or move media	Scope the inventory to media categories defined in the policy and keep it in a document system that owners can update directly
Document control tooling or licenses	Recurring license or hosting cost	Number of users who edit or approve policies, and whether version history and access roles are needed	Evaluate self-hosted open-source wiki or documentation platforms that offer version history and role-based permissions, and confirm each feature against the vendor documentation
Dissemination and acknowledgment effort	Recurring with each policy change	Number of defined roles, staff turnover, and whether acknowledgments are collected manually or through a system	Assign acknowledgments to role groups, and record them in the same platform that holds the policy
Recurring review cycle	Recurring at the defined frequency and after defined events	Frequency the organization sets, the number of triggering events (such as incidents or system changes), and the number of owners	Tie reviews to existing change and incident processes so reviews happen as part of work already scheduled
External review or gap assessment	Optional, one-time or periodic	Whether the organization wants independent feedback before an assessment, and the size of the policy set	Request a written scope limited to MP-1 and its procedures, with deliverables named in advance
Auditor or assessor sampling	Recurring at each assessment cycle	How many policy versions, approvals and distribution records the assessor samples, and how easily they can be retrieved	Keep approval history, dates and distribution records in one place so samples can be produced without rework

How XWiki and BookStack can hold MP-1 documents as evidence

MP-1 is satisfied by a documented media protection policy and procedures that are disseminated, owned and reviewed on a schedule. A self-hosted wiki can hold those documents, keep their history and control who edits them, but the tool only stores the record; the organization still decides what the policy says and who approves it.

XWiki version history for policy records

XWiki is licensed under LGPL-2.1-or-later and keeps every change to a page under version control, recording what changed, when and by whom. For MP-1, this gives assessors a trail showing when the media protection policy and procedures were revised and by whom. Check that the version history on your deployment covers the attachments and linked procedure documents you intend to use as evidence, and confirm how long old versions are retained before relying on them.

BookStack role-based ownership

BookStack assigns user abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. This supports controlled ownership of MP-1 content: the policy owner can edit the policy book while procedure authors edit only their chapters, and readers can view without editing. Confirm the role model in your version against the documentation, and test that the people you name as the designated official can actually approve changes.

Decisions the tools do not make

Neither tool decides what the MP-1 policy must address, who the designated official is, or how often the policy is reviewed. The organization must set the purpose, scope, roles, management commitment and coordination terms, and define the review frequency and the events that trigger an update. Record the approval step in the document itself, because an assessor will look for evidence of management sign-off, not for the wiki's permission settings.

Features to confirm before relying on them

Before treating either tool as evidence, confirm with the vendor and in your own deployment that version history, role permissions, audit logging and backups behave as the documentation describes. Check whether edits by administrators are logged, whether deleted pages can be recovered, and who can alter version records. Keep a dated export of the approved policy outside the wiki so the approved version survives a platform failure.

Who writes, reviews and tests the MP-1 policy

The organization owns MP-1. Its policy owner drafts or approves the media protection policy, a designated official manages it, and management commits the resources and approves the document. Legal and records staff check that the policy agrees with retention obligations, contracts and any sector rules that apply to the organization. Under MP-1, the policy and procedures must be disseminated to defined roles and reviewed at a defined frequency and after defined events, so the organization must set those values itself.

Policy ownership: Name one owner for the policy and one designated official, and record both in the document.
Scope decisions: Decide whether the policy is set at organization, mission or business process, or system level, and state which media types it covers, digital and non-digital.
Review triggers: Define the review frequency and the events that force an update, such as a security incident or a change in media handling.
Dissemination records: Keep proof that the policy reached the defined roles, such as acknowledgment records.
Management commitment: Keep signed approval from a senior official.

Confirm internally who signs the policy and where the approved version is stored, because assessors will ask for both.

Common questions about MP-1 policy and procedures

Can we write and maintain the MP-1 media protection policy in-house?

Yes. MP-1 is a policy and procedures control, so the organization owns it and can write it with its own staff, provided the people involved understand the systems and media in scope. The policy must address purpose, scope, roles, responsibilities, management commitment, coordination and compliance, and it needs procedures that put it into practice. Internal teams often handle the drafting well and struggle with the less visible work: confirming the policy matches how media is actually handled, getting leadership sign-off, and keeping review dates current. An implementation partner can help prepare the documents and the evidence trail, but the organization approves the policy and decides what it commits to. Only an independent assessor can judge whether the control is met.

How much effort does an MP-1 policy take, and what drives it?

The effort depends mainly on how many kinds of media and systems the policy must cover, how many documents already exist, and how many people must review and approve the text. Effort rises when media types are inconsistent across departments, when procedures are undocumented, or when the organization must align the MP policy with its other SP 800-53 family policies and its risk management strategy. It falls when a clear inventory of digital and non-digital media exists and when an existing policy template is already used for other control families. No effort figure is supplied for this topic, so ask any partner to state the effort in a written scope that lists the documents, reviewers and review cycles included.

How long does it take to get MP-1 documented and ready for assessment?

No duration is supplied for this work, so confirm it with a written scope before committing. The timeline depends on the number of documents to produce, the number of approvers, how quickly the organization can confirm its media inventory and handling practices, and whether the procedures must be drafted from scratch. Delays usually come from waiting for management approval and from discovering that current practice differs from what the policy says. Ask any partner to show the phases, the review points and which items depend on the client, so you can see where time is likely to be lost.

Can one media protection policy cover several systems?

Yes, MP-1 allows the policy to be set at the organization, mission or business process, or system level, so one policy can serve several systems if its scope and procedures reflect how each system handles media. Many organizations use a single organization-level policy with system-specific procedures for systems that handle different media or higher information categories. The assessor will check that the policy's scope matches the systems being assessed, so list every system and media type the policy must cover. Where systems differ meaningfully, plan procedures for each rather than stretching one document beyond what it can support.

What must the organization supply to an implementation partner?

The organization should supply the facts a partner cannot discover on its own. That usually includes the list of systems and sites in scope, an inventory of digital and non-digital media and where it is kept, existing security and records policies, the names of the roles that own media handling, the organization's risk management strategy, and any requirements from contracts, regulators or the authorizing official. Decisions also stay with the organization, including the review frequency, the events that trigger an update and who approves the final text. Ask the partner to list these inputs in the written scope so gaps are visible before work starts.

Can a partner make the assessor's decision on MP-1?

No. An implementation partner can prepare the policy, procedures and evidence, but the organization owns its controls and only an independent assessor or authorizing official can determine whether MP-1 is met. SP 800-53A describes the examine and interview methods an assessor uses for this control, including reviewing the media protection policy and procedures and interviewing personnel with media responsibilities. A partner's role is to make those documents accurate, current and easy to find, and to prepare staff for the interviews. Treat any promise of a particular assessment outcome as a warning sign.

How DeployOpen prepares MP-1 policy and evidence

DeployOpen helps organizations prepare the media protection policy, procedures and documentary evidence that MP-1 asks for, inside the client's own infrastructure. The organization owns the policy and its approval, and an independent assessor reviews the result.

How we scope

Confirm which systems and media types the MP-1 policy must cover, digital and non-digital
Agree which level (organization, mission or business process, or system) the policy will be set at
Record the named official who will manage the policy and the review frequency in the written scope

How we build

Draft the policy covering purpose, scope, roles, responsibilities, management commitment and coordination
Write the procedures that put the policy into practice for each media handling activity in scope
Configure the self-hosted document platform so each version of the policy and procedures is tracked

How we hand over

Deliver the policy, procedures and a document register mapped to the MP-1 determination statements
Provide a dissemination record showing which defined roles received each version and when
Walk the owners through the documents so they can answer assessor questions on the policy

How we support

Support is available as a retainer for scheduled policy reviews and updates after defined events
Retainer work can cover the document platform, backups and upgrades in the client's environment
Confirm with the auditor or assessor which evidence formats and review dates they expect before work begins