MP-5 Media transport: requirements and evidence

What MP-5 media transport requires and why it is hard to evidence

An assessor or customer who asks for transport controls on media leaving controlled areas wants to know one thing: when media moved outside your facilities, was it protected, tracked and handed only to people allowed to move it? MP-5 Media transport answers that question. It requires you to define the media types in scope, define the controls that protect that media while it is in transit outside controlled areas, keep accountability for the media throughout the move, document transport activities, and restrict transport to authorized personnel. In plain terms, the control covers the courier, the shipment, the hand-off and the record of each. The control is allocated to the moderate and high security control baselines in SP 800-53B. It is not in the low baseline, and it is not part of the privacy baseline. Release 5.2.0 defines one active enhancement for MP-5, which covers custodians, but no enhancement is allocated to a baseline, so the base control is the part most assessments test. Confirm your system's impact level before you commit effort here, because a low-impact system may not need MP-5 at all. The hard part is evidence, not design. Transport is often informal: a laptop goes home with an employee, a backup tape goes to an off-site vault by car, or a drive is posted to a vendor for repair. None of these moves usually generates a record, and the people doing them rarely think of themselves as transporting regulated media. Start by asking your asset owners and facilities staff to list every route by which media leaves controlled areas, then check whether each route has a named custodian, a documented handoff and a retained log. Where a route has none of these, the gap is what an assessor will find first.

Which media, systems and third parties fall under MP-5 scope

MP-5 applies only where the organization defines media that leave controlled areas, so the scope starts with the organization's own choices about media types, systems and impact level. Each decision below changes how many transport events must be controlled, documented and evidenced, and the cards show what to settle before counting the work.

Defined media types

MP-5 protects only the media the organization has defined, so the first decision is the list itself. Backup tapes, encrypted drives, removable media and paper printouts each carry different transport risk, and a broad definition widens every later step. Write the list into the media protection policy, name the owner of each type, and confirm that the list matches what staff actually move.

Systems that produce media

Map which systems create, copy or export defined media, including backup jobs, reporting tools, imaging workstations and document scanners. A system that writes to removable media or prints sensitive records adds transport events that the assessor will expect to see documented. Use the system inventory as the starting point and confirm that exports from each system are captured, not only the primary data stores.

Couriers and carriers

When a courier, mailroom or tape rotation service moves media, the organization still owns accountability for that media during transport. Confirm who signs for each handoff, whether the carrier is authorized, and how custody transfers are recorded. Contracts should state the carrier's duties for tamper evidence, chain of custody and incident notice, and the transport log should record each change of custodian.

Cloud and colocation providers

Media moved to or from a cloud region, a colocation facility or a provider's offsite vault leaves the organization's controlled areas even when no person carries it. Identify which provider operations count as transport, which records the provider supplies, and how the organization obtains them. Shared responsibility terms do not transfer the MP-5 obligation, so confirm in writing which party keeps each transport record.

Impact level and baseline

SP 800-53B allocates MP-5 to the moderate and high baselines only, so a low-impact system does not carry this control by default. A moderate or high system carries the control and its single active enhancement, which concerns custodians. Confirm the impact categorization in the system security plan, because a change in impact level changes whether MP-5 applies at all.

Number of transport events

The scope determines how many transport events the organization must control and document, and that count sets the size of the evidence set. A small set of defined media moved by one carrier produces a short log, while many media types, several systems and multiple providers produce many records each needing custodian and authorization evidence. Ask for a written count of transport flows during scoping, since the count drives the effort of sampling and assessment.

How an assessor tests MP-5 under SP 800-53A

SP 800-53A Rev. 5 assesses MP-5 Media transport through six determination statements, and each one is checked with some combination of examine, interview and test methods. For an assessor, the job is to confirm that the organization has defined which media are covered, that transport outside controlled areas is protected and accountable, and that the people and mechanisms doing this work actually behave as the documentation says. The assessment is a record review plus observation of practice, so the evidence an organization prepares should match the way an assessor will walk through it. The NIST CPRT entry for MP-05 is the natural place to read the control and its related items alongside the assessment procedure.

On the examine side, an assessor typically asks for the media protection procedures that cover transport, the access control policy and its procedures, the authorized personnel list for moving media, and a sample of the system media that have actually left a controlled area. The authorized list is where many gaps surface: an assessor will compare it against who signed for, carried or received a given item. Organizations should confirm that transport procedures name the defined media types, the protection expected in transit, and who may authorize a movement, and that the list is current and reviewed. Interviews come next. The assessor will speak with personnel who hold media storage and protection responsibilities, and with system and network administrators who manage the systems that hold or process the media. Each group should be able to describe, in their own words, how a transport is requested, approved, logged and closed.

The test method looks at whether the organizational processes and supporting mechanisms work in practice. Here the assessor may ask for a transport log or chain-of-custody record for a sample of movements, check that authorized personnel were the ones moving media, and verify that protection mechanisms such as encryption or locked transport containers were applied where the organization says they were. Where media are digital and the protection depends on encryption, the assessor will expect the key handling to be documented. Before the assessment, the organization should run this walkthrough itself on a few real movements, confirm the records are complete, and decide which records an assessor can sample without delay. The assessment owner stays with the organization, and only the independent assessor reaches a finding on each determination statement.

What assessors request for MP-5 and where findings usually arise

This table maps the SP 800-53A examine, interview and test methods for MP-5 to the artifacts an assessor asks for and the gaps that tend to appear. Read each row as a question the assessor will ask and the document or record that answers it.

Assessment method	Assessor action and artifact requested	Typical gap
Examine	Review the media protection policy and procedures covering transport, the access control policy, and the authorized personnel list for transport tasks	Authorized personnel list is out of date, does not match current staff, or does not name custodians
Examine	Inspect the system media inventory and the defined media types the organization has chosen to protect in transit	Media types are not defined, so the assessor cannot tell which transports fall under MP-5
Interview	Ask personnel with media storage and protection responsibilities how transports are requested, approved and recorded	Staff describe a process that differs from the written procedure or vary between sites
Interview	Ask system and network administrators how media leaving controlled areas is handled, including backup tapes and encrypted drives	Administrators are unaware of transport rules for backup or replacement media
Test	Walk through a sample of transport events and check the documentation kept for each movement	Transport logs are missing for some movements, or entries lack dates, sender, recipient or chain of custody
Test	Verify the mechanisms that protect media during transport, such as encryption, tamper-evident packaging or approved couriers	Protection is described in policy but cannot be shown for specific shipments

How to implement MP-5 transport controls in sequence

This sequence turns the MP-5 requirement into a working transport process, from the list of media that may leave controlled areas to a tested set of records that an assessor can examine.

Define media types and transport conditions
Start by listing every media type your systems produce or hold that may leave a controlled area, including removable drives, backup tapes, optical discs and printed material. For each type, record the conditions under which it may travel, such as destination, sender, recipient, and whether it carries data above a defined sensitivity level. The output is a defined media list with transport conditions attached. The step is done when the system owner signs off that no media type in scope is missing from the list.
Set protection and control methods for each media type
For each media type on the list, choose the protection that applies in transit, such as encryption of the contents, tamper-evident packaging, locked containers or a courier with a defined chain of handling. Document the method in the MP-5 procedure and link it to the media marking and storage rules already defined under MP-3 and MP-4. The output is a protection matrix that maps each media type to its transport controls. Confirm the matrix with your security team and your data owners before it is used.
Name and authorize transport personnel or custodians
Identify which roles may move media outside controlled areas and, where your risk assessment calls for it, name a custodian who is accountable for each movement. Record the authorization in an authorized personnel list that states who may transport media, for which media types and for which routes. Review the list on a schedule you define in your policy and remove access when a person changes role or leaves. The output is the authorized personnel list, and the step is complete when every person named can be traced to an approved role.
Design the transport documentation method
Decide how each movement will be recorded before any media leaves a facility. A transport log template should capture the media identifier, the originating and receiving locations, the custodian, the date and time of hand-off, the condition of the packaging at each hand-off and the confirmation of receipt. Decide whether the log is kept on paper, in a ticketing system or in an asset platform such as GLPI, and document where records are stored and who can read them. The output is the approved log template and its storage location.
Run a dry-run transport and collect the records
Before live use, move a representative item through the full process, including a hand-off, a handling step and a receipt, using the authorized personnel and the log template. Check that the protection method was applied, that the log entries are complete and that the chain of custody can be reconstructed from the records alone. Record any gaps, correct the procedure and repeat the dry run where a gap affects accountability. The output is a completed dry-run log and a short list of corrections with owners. Keep this package, because an assessor examining the transport process will ask for evidence of how it works in practice.
Confirm assessor evidence and schedule ongoing review
Map each artifact to the MP-5 determination statements in SP 800-53A, which ask assessors to examine procedures, the authorized personnel list and system media records, interview the people responsible and test the mechanisms in use. Confirm with your independent assessor which evidence format they accept and how far back they will sample transport logs. Set a review cycle for the media list, the personnel list and the log template, and record each review. The output is an evidence index for MP-5 that names the owner of every item.

Transport options and when custodians are needed

An internal courier is an employee who carries media between the organization's own sites, data centers or offices. MP-5 expects the media to stay protected and controlled in transit, that accountability is maintained, that transport is documented, and that only authorized personnel perform it. The courier's identity becomes a central piece of evidence, so the organization should name who carries each shipment and record when it leaves and arrives.

Authorized courier list: Keep a current list of personnel permitted to transport media, reviewed when roles change.
Chain of custody log: Record the media identifier, sender, courier, recipient, departure and arrival times, and any handoffs.
Protective packaging: Define the sealing, locking or encryption method used for each media class.
Escalation for loss: Document the steps for reporting missing or delayed media.
Reconciliation: Compare logged arrivals against the inventory maintained under MP-4.

Before relying on this route, confirm with your assessor whether a named custodian is required, and whether the custodian enhancement is part of your tailored baseline.

Evidence that satisfies MP-5 and how to keep it current

An assessor testing MP-5 Media transport looks for a documented transport procedure, a named set of people allowed to move media, and records that show what moved, when, and who held it. The cards below cover the artifacts that connect those points and the routine checks that keep them accurate between assessments.

Defined media and transport procedure

This is the written procedure that names which media types are covered, what counts as leaving a controlled area, and the protection required in transit, such as encryption, locked containers, or tamper-evident seals. Assessors compare it against what staff actually do. Review it whenever a new media type, courier or transport route is introduced, and confirm that the MP-1 policy references it. Ask your team to confirm the defined media list matches the current asset inventory.

Authorized personnel list

This list names the individuals or roles permitted to transport covered media, and it is the first document an assessor requests when testing restriction to authorized personnel. Keep it tied to HR and access records so that a departure or role change removes transport rights the same day. Reconcile it against courier contracts and badge data at a fixed interval, and record each review with a date and approver.

Transport and chain-of-custody logs

Logs record each movement of media: the item identifier, origin, destination, departure and arrival times, the custodian at each handoff, and any signatures or receipts. They show that accountability was maintained during transport, which is the core of MP-5. Store logs in a system that prevents silent edits, and where possible, generate entries from your asset management platform, such as GLPI, rather than from free-text spreadsheets.

Packaging and protection records

These records show how each shipment was protected: container type, encryption method and key custodian for encrypted media, seal numbers, and any environmental controls. They support the requirement that media be protected while in transit and give assessors something concrete to examine. Confirm encryption settings against the vendor documentation for your storage and key tooling, and sample shipments each quarter to verify the packaging matches the procedure.

Exception approvals and log reviews

Exceptions cover transports that deviated from the procedure, such as an emergency courier or a non-standard route, and each one needs a documented justification, an approver, and a follow-up. Periodic log reviews, ideally monthly, show that someone checks the transport records for gaps, unmatched handoffs and late arrivals. Record the reviewer, the period covered and the findings, and track any corrective action to closure so the review itself becomes evidence.

What meeting MP-5 costs in money and effort

This table breaks down the cost components of meeting MP-5 Media transport, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. No prices are supplied for this topic, so use the drivers to shape your scope and quote requests rather than as budget figures.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Transport protection tooling (encryption of media or transport containers)	Software vendor or internal IT for licenses; implementation partner for setup	Licenses often recurring; setup one-time	Number of media types in scope and whether protection is built in or bought. Self-hosted open source can remove license spend but still needs hosting and support staff.
Engineering time to define transport procedures and logs	Internal security and policy staff, or an implementation partner on a fixed-scope engagement	One-time, with periodic revision	How many media types, sites and transport routes must be covered, and how much existing procedure can be reused from MP-1 and MP-4 work.
Custodian and staff time for transport records and accountability	Internal staff named as custodians and their managers	Recurring for every transport event	Volume of media movements and whether logging is manual or pulled from asset and ticketing systems such as GLPI.
Authorized personnel list and access reviews	Internal HR, security and system owners	Recurring, typically on the organization's review cycle	Staff turnover, number of roles allowed to transport media, and how easily the list is kept in sync with identity records.
Evidence upkeep (transport logs, inventories, exported reports)	Internal compliance or operations staff	Recurring	Whether evidence is generated automatically by the platform or assembled by hand before each assessment.
External review or readiness assessment	Independent consultant or implementation partner, if engaged	One-time per review cycle	Scope of the review, number of systems covered, and whether the reviewer also prepares the evidence.
Auditor or assessor sampling	Independent assessor or certification body	Recurring per assessment cycle	Number of transport events the assessor samples and how complete the transport records are. Confirm the assessor's approach and fees in writing before work begins.

How self-hosted tools support MP-5 evidence

Nextcloud is licensed under AGPL-3.0-only. Its server-side encryption protects file contents at rest on local and external storage, with the keys kept on the server. This helps when digital media is moved as files through a self-hosted share, because the stored copy is encrypted. It does not address the physical movement of a drive or tape, and it does not hide what the files are called.

File contents only: server-side encryption protects file contents at rest, so it supports the protection element of MP-5 for digital media stored in Nextcloud.
Names and structure exposed: file names and folder structure are not encrypted, so an assessor should expect that metadata to remain visible to anyone with storage access.
Server-held keys: because keys are kept on the server, the evidence question is who can administer the server and the keys, not only who can reach the files.
Storage scope: confirm which local and external storage mounts are covered by encryption in your configuration.
Transport gap: Nextcloud does not log a removable drive leaving a facility.

Confirm the encryption settings and key handling against the Nextcloud encryption configuration documentation in your own environment before you cite them as evidence.

Common MP-5 gaps and how to close them

Most MP-5 findings come from transport that happens outside a documented process, not from missing policy. The gaps below cluster around who may move media, how custody changes hands, what gets logged, and whether the media is protected while it moves. Each closure step gives an assessor something specific to examine and test.

Informal courier use

Staff hand drives, tapes or printed records to a colleague, a taxi or a personal car without a defined transport method. MP-5 expects defined controls for media outside controlled areas, so the first check is whether your procedures name the approved carriers and the conditions for using them. Close the gap by listing approved transport methods in the media protection procedures and removing ad hoc options from the process. Ask a sample of staff how they would move a drive to an off-site location and compare the answers to the written procedure.

Missing custody handoffs

Media changes hands at pickup, at every intermediate stop and at delivery, and each change is a point where accountability can break. Assessors look for a record that shows who had the media at each step. Close the gap with a chain-of-custody form that requires the sender, carrier, receiver, time and media identifier at each handoff, and require the receiver to sign before the sender's record is closed. Test the process by tracing one shipment from start to finish.

Transport logs that cover only some events

Many programs log the shipment departure and the final delivery but say nothing about the stops, delays or handoffs between them. A log that skips those events cannot show accountability for the whole transport. Define the events that must be recorded, including departure, each custody change, unplanned delays and arrival, and make the log a required field in the transport workflow. For inventory of the media itself, a configuration or asset tool such as the GLPI Assets module can hold the media record that the transport log references.

Unencrypted media in transit

Media with sensitive content that travels unencrypted can expose the information if it is lost or stolen, even when the handling process is sound. MP-5 requires defined protection during transport, and encryption of the contents is a common way to meet that need for digital media. Confirm which media types are in scope, require encryption for them before they leave a controlled area, and store the key separately from the media. Where files are held on a self-hosted service, Nextcloud server-side encryption protects contents at rest but does not hide file names or folder structure, so check whether those names are sensitive.

Stale authorization lists

The list of personnel authorized to transport media should match current roles, and many lists are not updated when staff leave or change duties. Assessors interview the people named on the list and check it against the authorized personnel record. Close the gap by assigning an owner for the list, tying updates to HR offboarding and role-change events, and reviewing the list on a defined schedule. Compare the list to directory accounts to find people who still appear on it but no longer hold the role.

Unmanaged transport keys and credentials

Some transport programs share passphrases or encryption keys among couriers, or keep them in shared documents, which weakens both the encryption and the restriction to authorized personnel. Keys used to protect transported media should be held in a managed secrets service with access limited to the people who need them and with rotation on a defined cycle. OpenBao's transit secrets engine can encrypt and decrypt application data without storing it and supports versioned keys with rotation, which fits workflows where a service handles the encryption step. Confirm with your own design whether that model suits your media types before adopting it.

MP-5 media transport questions buyers ask

How much effort does MP-5 media transport take to meet?

The effort depends mostly on how many media types and transport routes your organization uses, and on whether transport processes already exist. MP-5 asks you to define the media in scope, set controls for media leaving controlled areas, keep accountability during transport, document transport activities, and limit transport to authorized personnel. Each of those items needs a written procedure, a named owner, and records that an assessor can sample. Organizations with a small number of media flows and an existing courier or chain-of-custody practice usually have less to document than those moving backup tapes, laptops and removable drives across several sites. Ask any implementation partner to size the work from a written scope that lists your media types, routes and systems.

Can we meet MP-5 in-house without outside help?

Yes, in principle. The organization owns its controls, so your own staff can write the transport procedure, define authorized personnel, and keep the transport log. Outside help is usually considered for preparing evidence, wiring logging and inventory tools into the process, or reviewing gaps before an assessment. An implementation partner such as DeployOpen can prepare systems and evidence for an assessment, but it does not assess controls or issue findings. Only an independent assessor or the authorizing official can make that determination. If you bring in help, confirm in writing which artifacts the partner will deliver and which ones your staff will maintain after handover.

What skills and staff time does MP-5 require?

MP-5 needs people who own the transport process, people who perform transports, and people who keep the records. In practice this means a control owner who can approve the transport procedure, custodians or drivers who follow it, and an administrator who maintains the list of authorized personnel and the inventory of media. Security staff should be able to review transport logs and confirm that a sample of movements matches the documented steps. Expect some recurring time for reviewing logs, updating the authorized list when roles change, and training new staff. The exact hours depend on your transport volume, and no duration is supplied here, so ask your team to estimate them from recent media movements.

How long does it take to implement MP-5?

No implementation duration is supplied for MP-5, so treat any timeline you receive as something to verify. What drives it is the number of media types in scope, whether transport procedures already exist, how many sites and carriers are involved, and whether the tools that produce evidence are already deployed. Organizations that must first inventory their media, agree on custody rules with business owners, and then train staff will take longer than those updating an existing procedure. Fixed-scope engagements agree deliverables and dates in writing before work starts, so ask for a written schedule tied to a defined scope instead of a general estimate.

Does MP-5 apply to low-impact systems?

No. In SP 800-53B, MP-5 is allocated to the moderate and high control baselines only, not to the low baseline. It is also not part of the privacy control baseline. Before you decide, confirm the impact level of each system, because the baseline you select follows from that categorization. If a contract or agency requires a control set that goes beyond the baseline for your system, the requirement comes from that contract rather than from the baseline itself, so confirm the exact obligation with the party that issued it. Your assessor can confirm how the baseline applies to each system in scope.

What should we confirm with an assessor before buying help for MP-5?

Before engaging a partner, confirm with your assessor which assessment objects they will examine and which evidence they expect. Under SP 800-53A, MP-5 is assessed through six determination statements using examine, interview and test methods. Ask the assessor to confirm the artifacts they will examine, such as the media protection procedures, the access control policy, the authorized personnel list and the inventory of system media, and the people they will interview, including staff responsible for media storage and system administrators. Ask how they will test the transport process, and whether the organization's chosen methods will satisfy them. Also confirm the authorization boundary, the impact level of each system, and who will sign the assessment report. Share these answers with any partner so the scope reflects what the assessor will actually test.

Where to confirm MP-5 requirements in the official sources

Before you rely on any MP-5 requirement in a plan, a contract or an assessment, confirm its wording and allocation in NIST's own publications. Start with the NIST CPRT entry for MP-05 in SP 800-53 Release 5.2.0, which shows the control statement, its discussion and the enhancement structure. Then open the SP 800-53B publication to confirm which baselines carry MP-5. Per the researched facts, MP-5 is allocated to the moderate and high baselines only, so a low-impact system should not inherit it by default, and that allocation is the first thing an assessor will check against your system's categorization.

For the exact enhancement text, use the OSCAL catalog in the usnistgov/oscal-content repository rather than a copied summary. The catalog lists one active enhancement for MP-5 with three more withdrawn, and the withdrawn entries should not appear in your control mapping. Because the catalog is versioned, record the release you assessed against, such as Release 5.2.0, and recheck it whenever NIST issues a new numbered release. The OSCAL profiles for the SP 800-53B baselines are published in the same repository and let you compare your selected baseline against the catalog programmatically.

Finally, confirm your own tailoring decisions. A baseline is a starting point, and an organization may add, remove or replace controls through tailoring, or adopt an overlay that changes how MP-5 applies to a specific system. Write down which baseline you started from, which MP-5 items you kept, and the rationale for any change, then have your authorizing official or assessor review that record. Where your organization's obligations come from a contract, regulator or agency, confirm with that party which NIST release and which tailoring they expect.

How DeployOpen prepares MP-5 transport controls and evidence

DeployOpen plans, implements and documents the technical and procedural pieces that MP-5 Media transport depends on, inside the client's own infrastructure. Independent assessors and the organization's own control owners remain responsible for judging whether the control is met.

How we scope

Agree in writing which media types, transport paths and controlled areas fall within the MP-5 scope.
Confirm with the client which custodians, roles and personnel are authorized to transport media.
Define the transport records, handling steps and documentation the client will retain as evidence.

How we build

Configure self-hosted platforms so that transport-related records, such as asset and custody data, are captured consistently.
Set up encryption and key management for media content so protection in transit is documented and tested.
Test the workflow end to end, including access restrictions and how transport events are logged.

How we hand over

Deliver the transport procedures, configuration records and test results in a format the client's assessor can examine.
Map each delivered artifact to the MP-5 assessment objects the client's assessor will review.
Walk control owners through the evidence so they can maintain it after the engagement closes.

How we support

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
Ongoing support, upgrades and continuous testing for the transport tooling are available as a retainer.
Confirm with your assessor which evidence they expect, since DeployOpen prepares evidence but does not issue assessment reports.