MP-2 Media access: requirements and evidence

What MP-2 media access asks for and why assessors focus on it

An assessment or contract that requires SP 800-53 MP-2 Media access expects you to restrict who can reach the media your organization has defined, and to show that the restriction works. In practice, MP-2 asks you to decide which media types count (the NIST discussion names flash drives, magnetic tapes, external or removable hard drives and optical discs as digital media, and paper and microfilm as non-digital media), which personnel or roles may access each type, and then to enforce that decision. The risk the control addresses is simple: anyone who can reach a drive, tape, disc or printed record can copy or remove the information on it without the system's other controls ever noticing.

MP-2 applies to the low, moderate and high security control baselines in SP 800-53B, but it is not part of the privacy control baseline. All of its numbered enhancements are withdrawn in Release 5.2.0, so the base control is the whole requirement. That keeps the scope narrow, but it also means the organization-defined parameters carry all the weight. Assessors will read your choices of media types and roles as the substance of the control, so vague or missing definitions tend to produce the findings.

What usually makes MP-2 hard is not the restriction itself but the inventory behind it. Removable media is often handled by facilities, IT, records management, legal and individual departments, and few organizations have a written list of which media types are in use or which roles may touch them. Confirm with your assessor how they expect the media types and roles to be documented, then build that list before you configure any enforcement, because the list is the artifact the examine and interview steps will test against.

Which media, people and systems MP-2 covers in your environment

MP-2 only works as well as the scope behind it. The organization decides which media types count, which roles may touch them and where the boundary sits, and that scope then has to match the system impact level that selects the SP 800-53B baseline. The cards below are the decisions that change the amount of work most, and the checks an assessor will make against them.

Defining the media types in scope

MP-2 applies to the digital and non-digital media the organization itself defines, so the first decision is the list. Start with the examples NIST gives, such as flash drives, magnetic tapes, external or removable hard drives, optical discs, paper and microfilm, then add backup cartridges, encrypted USB enclosures and any device that stores system data. Record each type in the media inventory and the policy so an assessor can trace every type to a restriction. Confirm the list with system owners, since a type missing from the definition is outside the control.

Roles authorized to access each media type

The second decision is which personnel or roles may access each defined media type. A backup operator may need tape access while a help desk analyst should not, and an archivist may hold the only key to paper records. Write these as roles rather than named individuals where possible, and link each role to a documented need. Assessors will compare the role list against access records, so the list must be current and approved by the owner of each media type.

Paper records in offices and archives

Non-digital media such as paper and microfilm is often the largest gap because it sits outside IT asset tracking. Decide whether the paper that holds system data, such as printed reports, change tickets with configuration details or retired microfilm, falls inside the defined scope. Office filing cabinets, records rooms and off-site archives each need a clear answer. Where paper is in scope, the organization needs locked storage and a sign-out or custody method that an assessor can examine.

Removable media in data centers and labs

Data centers, test labs and cyber ranges often use removable drives for imaging, firmware updates and log transfers, and those uses are easy to overlook. Decide which removable devices may be connected to which systems and who may bring them into controlled rooms. Lab environments that reuse hardware between projects need the same access rules as production, because media that moves between environments can carry data into scope without anyone recording it.

Third parties that handle media

Backup vendors, couriers, shredding services and offsite storage providers may take custody of media without ever accessing the system itself. Identify each third party that receives, carries or destroys in-scope media, then decide how their personnel are restricted and what contract terms and records apply. Ask for their access procedures and custody logs before signing. Responsibility for the restriction stays with the organization even when the vendor performs the handling.

Baseline and impact level set the boundary

The organization sets the scope, but the system impact level determines which SP 800-53B baseline applies. MP-2 is part of the low, moderate and high baselines and is not in the privacy baseline. A higher impact level usually means a wider media scope, stricter role definitions and more evidence. Confirm the impact level with the authorizing official or system owner before fixing the scope, and document why each media type is in or out.

How an assessor tests MP-2 media access

This table maps the two MP-2 determination statements in SP 800-53A Rev. 5 to the examine, interview and test activities an assessor performs, the evidence each activity asks for, and the gaps that most often appear. Read each row as one assessment activity, and use the evidence column to prepare your files before the assessor arrives.

Assessment activity	Evidence the assessor expects	Common findings
Examine: media access restriction procedures	Documented procedures that name the digital and non-digital media types in scope and the roles allowed to access each type	Procedures exist but do not list media types such as external drives, tapes or printed records
Examine: access control policy and procedures	Current access control policy showing how media access follows role-based permissions, with review and approval dates	Access control policy does not mention removable or physical media, so media rules float free of the access model
Examine: media storage facilities and access control records	Facility access lists, locked storage logs, key or badge records and a current inventory of defined media	Storage areas have no access list, or the list was never reviewed after staff changes
Interview: personnel with media protection responsibilities	Named owners who can explain which media are restricted, who approves access and how exceptions are handled	Responsible staff describe the rules differently, or cannot name who approves access to backup tapes
Interview: system and network administrators	Consistent explanations of how removable media access is granted, revoked and monitored on managed endpoints and servers	Administrators rely on defaults and cannot show which devices or groups are permitted
Test: processes restricting information media	Walkthrough of request, approval, issuance, use and return or destruction of restricted media, with sample transactions	Process exists only in practice and no sample request records can be produced
Test: mechanisms implementing media access restrictions	Configuration output, device policy results and test results showing that unauthorized users are blocked from defined media	Restrictions are configured on some endpoints but not all, and no passing or failing results are retained
Test: restriction changes over time	Records of access reviews, removals after role changes and tickets showing corrections to failed checks	Access lists were never reviewed, and former staff keep access to media storage or removable devices

How to implement MP-2 media access restrictions in six steps

This sequence moves an organization from undefined media handling to a documented, enforced and periodically reviewed set of access restrictions, with evidence an assessor can examine. Each step produces a specific artifact that the next step depends on.

Define the media types in scope
Start by listing every type of digital and non-digital media your systems and facilities handle. For digital media, include flash drives, magnetic tapes, external or removable hard drives and optical discs. For non-digital media, include paper and microfilm, along with any other formats that carry organizational information. Assign each type to the systems, facilities and data categories where it appears. The output is a media inventory, owned by the system owner or security team, that states which media types MP-2 applies to. Confirm the list with the people who actually move media, since informal practices often sit outside formal inventories.
Define authorized personnel and roles per media type
For each media type in the inventory, name the personnel or roles allowed to access it. The restriction should follow job function and the information's sensitivity, not convenience. Record the roles, such as backup administrators for tapes or records staff for paper, and the approving authority for each. Tie role assignments to your identity and access records so that an assessor can compare a person's access against the approved list. The output is a role-to-media access matrix signed off by the data owner. Confirm with your identity team how roles are provisioned and removed, because a matrix that does not match directory groups will fail review.
Document the media access restriction procedure
Write the procedure that tells staff how restrictions are applied and checked. It should cover how access is requested, approved, granted, logged and withdrawn for each media type, who may hand over media, and what happens when access is no longer needed. Link the procedure to the media protection policy so that MP-1 and MP-2 agree. Assign a named owner and an approval record. The output is an approved procedure document that an assessor can examine against the determination statements in SP 800-53A. Ask a second reviewer to walk through one example request end to end to confirm the document is followable.
Implement enforcement for digital media
Put technical controls behind the matrix. Device and endpoint controls can restrict which users can read or write removable media, and encryption can protect stored content so that a lost drive does not expose its contents. Where you use server-side encryption on file storage, confirm what it covers: Nextcloud's server-side encryption protects file contents at rest but does not encrypt file names or folder structure, so the procedure must account for that gap. Record storage locations for backups and tapes, and restrict who can reach those locations. Confirm with your platform and endpoint vendors which features exist in your versions. The output is a configured control set plus a short mapping showing which control enforces which matrix row.
Implement enforcement for non-digital media
For paper and microfilm, use locked storage in a controlled area with keys or badges limited to the roles in your matrix. Set up a sign-out log that records who takes each item, when, the purpose and the expected return. Require a named custodian for each storage container and a periodic check that the log matches what is on the shelf. Physical access to storage areas should align with your physical protection controls. The output is a storage register, a sign-out log template in use, and a list of key or badge holders reconciled against the matrix. Confirm the arrangement with facilities staff so that the locks and logs match how the space is actually used.
Review access lists and collect evidence
Set a review cycle for the role matrix, storage keys, device control settings and sign-out logs, and record the cycle in the procedure. At each review, compare current access against the approved matrix, remove access no longer needed, and log the changes. For endpoint policy checks, tools such as Fleet policies can run yes or no osquery questions on devices and show which devices pass or fail, and Wazuh's Security Configuration Assessment can check endpoint configuration against YAML policies with custom checks added. Keep the review records, the policy results and the sign-out logs together as evidence. The output is a dated review record and an evidence folder that an assessor can sample against the examine, interview and test methods in SP 800-53A. Ask your assessor early which samples they expect to see.

MP-2 media access evidence that passes assessment

An assessor testing MP-2 wants to see that the organization defined its media types and authorized roles, wrote down how access is restricted, and can show records that the restrictions work. The cards below cover the artifacts that carry that proof and how to keep each one current between assessments.

Defined media type list

The organization must name the digital and non-digital media it restricts, such as flash drives, magnetic tapes, external or removable hard drives, optical discs, paper and microfilm. Keep the list as a controlled document with an owner and a revision date, and reconcile it against the media inventory each review cycle. Confirm that every media type in the inventory appears on the list, since an assessor will compare the two.

Role-based access list per media type

For each media type on the list, record which personnel or roles may access it and under what conditions. Assessors check that the roles match current job functions, so review the list when staff move or leave and tie entries to the identity provider groups or badge roles that enforce them. Ask whether any role grants access to media that the policy does not name.

Media access procedure document

The procedure explains how access is requested, approved, granted, revoked and checked for each media type, and it should match what staff actually do. Assessors examine it alongside the access control policy, so cross-reference the two and record the date of each revision. Interview a sample of staff to confirm they follow the written steps.

Storage facility access and sign-out logs

For paper, microfilm and removable media kept in locked storage, keep access records that show who opened the storage area, when, and which items were checked out and returned. Reviewers look for gaps, unexplained entries and items missing from the log. Reconcile the logs against the media inventory on a set schedule and retain them for the period your own records policy requires.

Configuration evidence for digital media

For digital media on endpoints, an assessor expects technical settings that block or limit access to removable storage. Wazuh Security Configuration Assessment can scan endpoints against YAML policies, largely based on CIS benchmarks and extendable with custom checks, and report failed items with remediation advice. Fleet policies ask yes or no questions of devices as osquery queries and show which devices pass or fail, which can support a removable media check. Confirm that each check fits your own media rules before relying on its result, and keep scan reports as dated evidence. Nextcloud server-side encryption protects file contents at rest but does not encrypt file names or folder structure, so it does not by itself restrict who can access media.

Interview notes and staff attestations

Assessors interview personnel with media protection responsibilities and system or network administrators, and they test whether the process works as written. Record the date, the attendees and the answers for each interview, and collect signed attestations from custodians that they understand their access limits. Refresh attestations when roles change and at the cycle set by your policy, so the evidence reflects the current staff.

Where open-source tools help with MP-2 and where they stop

Open-source tools can produce evidence for parts of MP-2, but none of them decides what counts as restricted media or who should be allowed to access it. The organization still defines the media types in scope, the personnel or roles authorized to access them, and the restrictions that apply. Tools then help show whether systems and endpoints behave as those decisions say they should. Before relying on any capability below, confirm it in your own environment, because feature sets change between releases and depend on how the tool is deployed.

Wazuh Security Configuration Assessment (GPL-2.0-only) checks monitored endpoints against YAML policies, most of which are based on CIS benchmarks and can be extended with custom checks on files, directories, registry keys and running processes. A custom policy could test whether a defined removable-media configuration is in place on endpoints that handle restricted information, but whether that check matches your access decision is for you to define and verify. Fleet (MIT) policies work differently: each is a yes or no osquery question, and the policies page shows which devices pass or fail. Fleet can answer questions such as whether a device has a specific USB storage setting enabled, but it cannot see a physical drive that is not connected to a managed device, and it cannot confirm who holds it.

Nextcloud (AGPL-3.0-only) server-side encryption protects file contents at rest on local and external storage, with keys kept on the server, but it does not encrypt file names or folder structure. Where restricted documents are stored there, assessors may ask how names and folder paths reveal sensitive information, so plan for that gap separately. OpenBao (MPL-2.0) transit secrets engine encrypts and decrypts application data without storing it, and supports versioned keys with key rotation, which helps where application data must not sit in plain form. None of these tools classifies media, proves physical custody of paper or microfilm, or replaces the access records, storage inventories and interviews that an assessor will examine for MP-2.

What MP-2 media access costs in money and effort

This table breaks the cost of restricting media access into components, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. Use it to structure a written quote and to decide which parts your own team can carry. No public price figures exist for MP-2, so each row tells you what to ask for rather than what to expect.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down, and what to ask for in a quote
Tooling and licenses	Software vendors or none if self-hosted open source is used	Recurring for commercial tools, one-time for setup	Number of endpoints and media types to monitor. Open-source options such as Fleet (MIT) and Wazuh (GPL-2.0-only) remove license spend but still need hosting. Ask the quote to separate license, hosting and support lines.
Owner time defining media types and access lists	Internal data owners, records managers and security leads	One-time for initial lists, recurring at each review	Number of media types in scope (flash drives, tapes, external drives, optical discs, paper, microfilm) and number of roles needing access. Ask who signs off each list and how often the list is reviewed.
Engineering time for technical enforcement	Internal platform engineers or an implementation partner	One-time build, recurring tuning	Number of managed endpoints and whether removable media is blocked, logged or both. Ask for the enforcement method, the platforms covered and the test evidence delivered.
Engineering time for reporting	Internal security engineers or an implementation partner	Recurring	Frequency of access reports and the number of systems feeding them. Ask how a failing device or unauthorized access attempt is reported and who receives the alert.
Physical storage and locking	Facilities teams and suppliers of lockable cabinets or safes	One-time for equipment, recurring for upkeep	Number of storage locations and volume of paper and tape holdings. Ask for a floor plan or list of storage locations and the access records kept for each.
Evidence upkeep	Compliance leads and system owners	Recurring	Number of storage locations, access lists and review cycles. Ask which records the assessor will sample and how long they must be retained.
External review or testing	Independent assessors or security testing firms	Recurring per assessment cycle	Scope of the assessment and the number of systems or sites tested. Ask whether the assessor examines records, interviews staff or tests mechanisms, since each method adds effort.
Third-party media handling	Courier, storage vendors or cloud providers that hold media	Recurring	Whether media leaves the organization and how many third parties touch it. Ask for the contract clauses that set access restrictions for each third party.
Auditor sampling	Independent assessor, billed by the auditor	Recurring per assessment cycle	Number of sampled media items, locations and access records. Ask the assessor to state the sample approach in writing before fieldwork starts.

Who does what: your team, an implementation partner and the auditor

Your organization owns MP-2. It decides which digital and non-digital media types fall under the restriction, which personnel or roles may access them, how access decisions are approved and recorded, and which procedures govern them. Those decisions must be documented, approved by accountable management and kept current, because an assessor will examine the procedures and the access control records directly. No implementation partner or auditor can make these decisions on your behalf.

Media inventory: define the digital media (such as flash drives, magnetic tapes, external or removable hard drives and optical discs) and non-digital media (such as paper and microfilm) in scope for your systems.
Authorized roles: name the personnel or roles allowed to access each media type and document the approval path for changes.
Procedures and policy: maintain the media access procedures that sit under your access control policy.
Sign-off and review: record approvals, review access lists on a defined cycle and retain the signed records.
Staff interviews: make sure the people with media protection responsibilities and system administrators can explain the rules, since assessors interview them.

Before engaging anyone, confirm with your own assessment team which of these artifacts they expect in your environment.

Where MP-2 programs usually fall short and how to close each gap

MP-2 assessors usually find the same weaknesses: the program was scoped loosely, the people allowed access were never pinned down, and the records cannot prove what happened. Each card below names one gap, why an assessor will notice it, and the fix that closes it. Work through them in order, because the media definition drives everything after it.

Media types never defined

MP-2 requires the organization to restrict access to the media types it defines, so an undefined list leaves the control with nothing to test. Teams often name flash drives and tapes but forget optical discs, external hard drives, paper case files or microfilm. Write one list that covers the digital types named in the NIST discussion and the non-digital types the organization holds, then tie each type to a system or storage location. Ask an assessor's sample question early: which media in this building are not on the list?

Broad or undocumented access roles

Access to media is often granted to 'IT' or 'staff' with no written role definition, so the personnel who may touch backup tapes cannot be named. MP-2 asks for access limited to personnel or roles the organization defines, so each role needs a written purpose, an owner and a list of named holders. Split broad groups into specific roles such as backup operator, records custodian or evidence handler, and document which roles may read, copy or destroy each media type.

Paper and microfilm outside the program

Digital media receives attention while paper case files, printed reports and microfilm sit in cabinets with no access rule at all. The control explicitly covers non-digital media, so an assessor will ask who can open the records room and how that is restricted. Bring these holdings into the same media inventory, apply the same role model, and keep a sign-out or key log for locked storage. Confirm the storage rules with the control owner before the assessment, since the procedure must match how the room is actually run.

Access lists not reviewed after staff changes

Access granted to a person who has moved teams or left the company often stays in place because no one connects HR changes to media permissions. Build a recurring review that compares current role holders against the access list, and trigger an out-of-cycle review when someone transfers or departs. Keep the reviewer's sign-off and the list version as evidence. Ask the organization which system ends a person's access to physical keys, vault codes and backup consoles, because these are often managed by different teams.

Removable media with no owner or inventory

A USB drive or external disk without a named custodian cannot be restricted, traced or recovered when it goes missing. Assign each removable device a unique identifier, a custodian and a storage location, and record issue and return dates. Reconcile the inventory against what is physically on hand at a set interval. Assessors commonly test this by picking a device from the storage area and asking who is responsible for it, so the answer should come from the record, not from memory.

Evidence that exists but is not dated or tied to the procedure

Access logs, sign-out sheets and review emails frequently exist, but they are undated, unsigned or not linked to the written media access procedure, so the assessor cannot show the restriction operated. Standardize each record with a date, a named reviewer and a reference to the procedure version it follows. Retain them in one location for the assessment period. Open-source tooling such as Wazuh Security Configuration Assessment or Fleet policies can show device state over time, but the organization must confirm which evidence its own records need.

MP-2 media access questions buyers ask before hiring help

How much effort does MP-2 media access take for a small organization compared with a large one?

For a small organization, MP-2 is mostly a short list of decisions and a few records: which media types are covered, who may access them, and where they are kept. For a large organization, the same control multiplies across more sites, more media types, more custodians and more systems, so the effort grows with the number of media locations and access roles rather than with the control text itself. The main drivers are how many kinds of digital media (flash drives, tapes, external drives, optical discs) and non-digital media (paper, microfilm) are in use, how many storage locations exist, and how many personnel or roles need access. Ask any partner to show how they will count these items in the written scope before agreeing to a price.

Can our team implement MP-2 without outside help?

Often yes, for a team that already has an access control policy, an asset inventory and someone who owns physical security. MP-2 asks you to define the media types and the personnel or roles allowed to access them, then show that those restrictions operate. Teams that struggle usually lack a clear media inventory, have no record of who holds keys or badges to storage areas, or have not agreed which roles count as authorized. Outside help is most useful when you need an independent view of gaps before an assessor arrives, or when technical enforcement on endpoints needs to be built and documented. Whatever you decide, the organization remains responsible for the control.

What does MP-2 require from our own staff?

Your staff need to own three things: the policy that names covered media and authorized roles, the access records for storage areas and removable media, and the people who can explain how restrictions are enforced. In practice that means a system or facilities owner who maintains the media inventory, managers who approve role assignments, and administrators who can show configuration state on endpoints. Assessors commonly interview personnel with media protection responsibilities and system or network administrators, so those people should be available and able to describe the process accurately. Plan for their time during the assessment window as well as during implementation.

How long does MP-2 implementation take, and what changes the timeline?

No researched duration applies to MP-2 specifically, so treat any number you hear with caution and ask the partner to explain its basis. The timeline is driven by how many media types and locations are in scope, whether an inventory already exists, how many roles must be defined and approved, and whether technical controls on endpoints need to be built or tested. Delays commonly come from unclear ownership between facilities and IT, from storage areas that have no access logs, and from waiting on decisions about which removable media to allow. A fixed-scope agreement with written deliverables and milestones makes the timeline easier to check.

Can an implementation partner issue an MP-2 assessment report?

No. An implementation partner can prepare systems, policies, records and technical evidence for MP-2, but only an independent assessor or auditor can test the control and issue a report or determination. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. Ask any partner to state this in writing, and ask who will perform the independent assessment and what the assessor will need from you, such as the policy, inventory, access records and interview availability. Keeping those roles separate protects the credibility of the result.

Do open-source tools satisfy MP-2 by themselves?

No. Open-source tools can produce evidence that supports MP-2, but they cannot make the organization compliant on their own. For example, Fleet policies can show whether devices pass or fail yes or no checks written as osquery queries, and Wazuh Security Configuration Assessment can check endpoints against YAML policies for misconfigurations. Neither tool knows which media types you define, who is authorized, or whether a paper record room is locked. The policy, role definitions, storage controls and physical records are still the organization's responsibility, and the tools are only one source of technical evidence. Confirm exactly which checks a tool can run in your environment before relying on it.

What should we ask a partner to include in a written MP-2 scope?

A useful written scope names the boundary and the deliverables, so you can compare proposals on the same terms. Ask for the following:

The list of digital and non-digital media types in scope, and the locations or systems that hold them
The roles and personnel the partner will treat as authorized, and who approves that list
The policy, procedure, inventory and access record templates the partner will prepare
The technical checks on endpoints, with the tools used and the evidence each one produces
A statement of who performs the independent assessment, and what the partner will not do
Milestones, acceptance criteria, dependencies on your staff, and the support period after handover

Ask for the fee and the schedule to follow directly from this list.

How DeployOpen works on this

DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure, then prepares the systems, restrictions and evidence an assessor will examine for MP-2 Media access. Your organization owns the control and the decision on which media types and roles are restricted, and an independent assessor is the only party that issues findings.

How we scope

Agree in writing which digital media types and non-digital media holdings fall inside the MP-2 scope.
Confirm with you which personnel and roles are authorized for each defined media type and storage location.
Identify the systems, endpoints and storage facilities that hold the media access restrictions to be evidenced.
Engagements are fixed-scope, with deliverables and timelines agreed before work starts; a quote follows from the written scope.

How we build

Configure endpoint policies that check whether managed devices meet the removable media restrictions you define.
Set up configuration assessment checks against your own media access policy, extended with custom rules where needed.
Implement encryption and key management for stored data on platforms that hold sensitive media content.
Test the restrictions with your administrators to confirm that the mechanisms work as the written procedures describe.

How we hand over

Deliver documentation of the media access restrictions, the roles granted access and the mechanisms that enforce them.
Provide exportable evidence such as policy results, configuration assessment reports and access records for the assessor.
Map the delivered artifacts to the MP-2 assessment objects so your assessor can examine and test them directly.
Walk your personnel through the procedures and record what was covered, so interview evidence is current.

How we support

Review the restrictions when the defined media types, roles or storage locations change.
Available as a retainer for ongoing support, upgrades and periodic re-testing of the controls.
Coordinate with your assessor and internal audit on evidence requests, without issuing any report or attestation ourselves.