MP-7 Media use: requirements and evidence

What MP-7 media use asks for and why it differs from MP-2

If your system is rated low, moderate or high under SP 800-53B and removable media is still allowed on it, MP-7 Media use is the control that decides which media can be connected and which devices can be used at all. The requirement has two parts. First, you define the types of system media you restrict or prohibit (for example, USB mass storage, optical drives or external disks) and the systems or components where those restrictions apply, then implement the controls that enforce them. Second, you prohibit portable storage devices in organizational systems when no one can be identified as their owner. The difference from MP-2 Media access is the question each control answers: MP-2 limits who may access media, while MP-7 limits which media may be used on systems. A person authorized under MP-2 can still plug in a device that MP-7 forbids, so the two controls need to be designed together.

The risk MP-7 addresses is unmanaged media carrying data in or out of your environment. An unidentified thumb drive can introduce malware, and a copy of sensitive records can leave on a device no one tracks. Several things make this hard in practice. You need a current inventory of the portable devices in use, including personal or spare devices that have never been registered. Enforcement has to reach every endpoint, which usually means a mix of operating system settings, endpoint management and device control tools that may not behave the same way across fleets. Exceptions are the hardest part: business units will need specific devices, and each approval should name the owner, the system and the expiry date. Confirm with your security team which media types your baseline defines, which systems they cover, and how an assessor will be shown the restriction in effect on a sample of machines.

Which systems, media and teams MP-7 covers

MP-7 applies to the low, moderate and high baselines, so the first scoping question is which systems fall into those baselines. The decisions below set how broad the media restrictions become, which components must enforce them and who signs off on exceptions. Each one shapes the evidence an assessor will ask for.

Baseline assignment for each system

SP 800-53B allocates MP-7 to the low, moderate and high baselines, not to the privacy baseline. Confirm the security categorization of each system first, because that determines whether MP-7 is selected at all. A system categorized as privacy-only processing outside these baselines will not carry MP-7 unless the organization tailors it in. Record the selected baseline and the tailoring rationale in the system security plan.

Defined media types to restrict

MP-7 requires the organization to define which types of system media are restricted or prohibited. Typical definitions cover USB mass storage, optical drives, memory cards and external drives, but the list must match the environment. Write the definition as a list an endpoint control can enforce, such as device classes or vendor identifiers, and note which types are allowed for specific roles.

Systems and components in scope

The defined systems or components are where the restriction applies, and that list is often narrower or broader than the authorization boundary. Workstations, servers, kiosks and industrial hosts may need different rules. Ask the system owner to list each component that can read or write removable media, so the scope matches what the mechanisms actually cover.

Related controls that change scope

AC-19, AC-20, PL-4, PM-12, SC-34 and SC-41 interact with MP-7 and affect what must be covered. AC-19 and AC-20 govern mobile devices and use of external systems, PL-4 sets rules of behavior, PM-12 covers insider threat programs, and SC-34 and SC-41 address non-modifiable executables and port restrictions. Map each one to the MP-7 scope so the same device rule is not written and tested twice with different boundaries.

Endpoint and platform owners

Endpoint management teams usually run the device controls, while platform engineering owns server and virtual machine configuration. Name the owner of each enforcement mechanism, including the team that can change a policy and the team that reviews failed checks. Without a named owner, a control that passes in one period can drift without anyone noticing.

Removable media policy and exceptions

The removable media policy sets what is allowed, who may request an exception and how long an exception lasts. Security, legal and the data owner should approve exceptions, and each one should record the device, the business reason and the compensating control. Prohibiting portable storage devices with no identifiable owner is a separate requirement, so confirm how unregistered devices are detected and removed.

How an assessor tests MP-7 media use

This table maps each SP 800-53A assessment method for MP-7 to what the assessor requests, who they interview and what they test. Read it as a checklist of the evidence to have ready before an assessor arrives, and note that the two determination statements require both documented restrictions and working mechanisms.

Assessment method	What the assessor asks for or does	Evidence that passes	Where it usually fails
Examine	Reviews the system use policy, procedures on media usage restrictions, rules of behavior and system configuration settings with associated documentation	A current policy naming the media types restricted or prohibited, procedures for approving exceptions, and configuration exports showing the restriction in force	Policy text exists but no configuration or procedure ties back to it
Interview	Speaks with personnel who have media use responsibilities and with system and network administrators	Staff can describe which media are blocked, who approves exceptions and how unknown devices are handled	Administrators describe controls that differ from the written policy
Test	Tests the organizational process for media use and the mechanisms that restrict or prohibit system media	A plugged-in unapproved device is blocked or logged, and the process produces a record of the event	Restriction is only documented, never exercised on a live endpoint
Determination statement (restriction)	Confirms the organization restricts or prohibits defined media types on defined systems or components	A defined list of media types and systems, with the mechanism mapped to each	Media types or systems are undefined, so coverage cannot be judged
Determination statement (ownership)	Confirms portable storage devices with no identifiable owner are prohibited on organizational systems	A rule that blocks unowned devices and a documented method for identifying device owners	Unowned devices still permitted because no owner check exists
Common finding: policy without enforcement	Assessor compares written restrictions with what the endpoint actually allows	Enforcement evidence per endpoint group, such as configuration state reports	No technical mechanism exists, only a statement in the policy
Common finding: no exception record	Assessor asks how a permitted exception was approved and when it expires	An exception register with approver, reason, scope and review date	Exceptions granted verbally with no record

Evidence that passes an MP-7 test

An assessor testing MP-7 examines documents, interviews the people who manage media use, and tests whether restrictions work on real systems. The cards below cover the artifacts that carry those checks and how to keep each one current between assessments, since a snapshot taken the week before an audit rarely shows sustained enforcement.

Media use policy and procedures

The policy and procedures document the defined media types, the systems they apply to, and who approves exceptions. Assessors examine them against the two determination statements in SP 800-53A. Keep a version history with review dates and an owner, and record each review in your change log so the document in force during the test period is clear. Confirm with your assessor whether they expect the procedures to cover removable media and personal devices separately.

Rules of behavior for users

Rules of behavior tell users which media they may connect, what they must do with unknown devices, and what happens if they breach the rules. Obtain a signed acknowledgment from each user and retain it with the account record. Refresh acknowledgments when the rules change, and ask the assessor how far back they will sample signed copies.

System configuration settings for device restrictions

Configuration exports show the mechanisms that restrict or prohibit media use, such as device control settings on endpoints or port policies on servers. Export them on a schedule and store the output with a timestamp and the hash of the configuration file. Compare each export with the approved baseline so that any drift appears as a change record instead of a surprise during testing.

Endpoint test results from scheduled queries

Test results show whether restrictions hold on each device in scope. Osquery queries run by osqueryd, or yes or no policies in Fleet, can report which hosts pass or fail a media-control check on a set cadence. Retain the daily or weekly results, not only the final summary, so the assessor can see both compliance and how failures were handled. Confirm the sample size and selection method with your assessor before the test.

Defined media types and systems list

The list names every media type and system or component covered by MP-7, and it must match the scope in the system security plan. Assessors compare the list with inventory records to find gaps. Update it when a new endpoint class, port or device type enters the environment, and keep the prior versions so the list can be matched to the test period.

Records of prohibited or unowned devices

Logs of prohibited devices, and of portable storage devices without an identifiable owner, show that the control operated in practice. Record the device identifier, the host, the date, the action taken and the person who closed the case. Velociraptor hunts can locate matching devices across endpoints, and their notebooks can hold the combined results. Ask your assessor whether they expect the handling records to include disposition of the device.

Approved exception records

Exception records document each approved use of a restricted media type, the business reason, the compensating controls, the approver and the review date. Keep them in a register that links to the affected devices and the scheduled tests that check them. Expired exceptions should be closed or renewed with a new approval, because assessors commonly test whether exceptions remain justified.

How to implement MP-7 media restrictions step by step

This sequence moves an organization from an undefined media policy to a tested restriction mechanism with documented exceptions and recurring evidence, so that an assessor can trace each MP-7 requirement to a named artifact.

Define media types and systems in scope
The organization's security or IT governance owner writes the media use rules into the media protection policy, naming the media types that are restricted or prohibited (for example, USB mass storage, optical drives or external drives) and the systems or components each rule covers. Define the rules in terms of your own environment, not as a generic list. The output is an approved policy section that lists each defined media type and each defined system, with the owner of each rule. The step is done when every restriction in the policy names both a media type and a system group, and an assessor reading the policy can tell exactly which devices are covered.
Inventory endpoints and removable media in use
Before choosing controls, the IT team records which endpoints, servers and removable media are actually in use today. Endpoint query tools such as osquery can list attached USB devices and hardware events across hosts, and an asset register can record the managed devices. Compare the results with the defined systems from the previous step to find gaps, such as unmanaged hosts or media types that appear in use but were never considered. The output is a current inventory of in-scope systems and a list of media types observed in use, with any unexplained devices flagged for review.
Set the restriction mechanism per media type
For each defined media type, the platform or endpoint team selects and configures the mechanism that restricts or prohibits its use, such as device control settings, operating system policies or endpoint protection rules. Record the setting, the system group it applies to and the change record that introduced it, using the organization's configuration management process. Confirm each mechanism's capabilities with the vendor or your own test before relying on it, because device control features differ by platform. The output is a configuration baseline that maps each defined media type to a specific setting on each defined system group.
Define the ownership rule for portable storage
MP-7 requires that portable storage devices with no identifiable owner be prohibited on organizational systems, so the policy must state how ownership is established. Define who issues removable media, how each issued device is registered to a named person or asset tag, and what happens when an unregistered device is connected. Decide the handling path for unowned devices, such as blocking on connection and routing to the security team for review or disposal. The output is a written ownership rule, a registration record for issued media and a documented handling procedure for unowned devices.
Test the mechanism against sample devices
The security team tests the configured restrictions with a set of sample devices that cover each defined media type, including at least one unregistered device, and records whether each restriction blocks use on each defined system group. Testers should also check the assessment objects in SP 800-53A, which include interviewing administrators and testing the processes and mechanisms that restrict media on systems. Keep the test scripts, the device list, the results and any failures with remediation tickets. The output is a dated test record that shows the restriction working or a documented gap with an owner and a retest date.
Document exceptions with approval and review
Some business needs will require a restricted media type on a defined system, so the policy should allow exceptions only through a written request. Each exception should name the device or user, the system, the business reason, the compensating controls and the approver, and should set a review date. Store exceptions in a register that the security team maintains and that the platform team can reconcile against the configuration baseline. The output is an exception register where each entry has an approver, a compensating control and a scheduled review, and where no active exception lacks one of these elements.
Set up recurring evidence collection
Establish a schedule for collecting the evidence that an assessor will examine, including the current policy, the configuration baseline, recent device scan results, the unowned-device handling log and the exception register. Fleet policies can ask yes or no questions of devices, such as whether a restricted media type is blocked, and show which devices pass or fail each policy. Velociraptor can collect artifacts from endpoints and its hunts can gather results across a group of systems, including offline machines when they reconnect. Confirm the retention period for these records with your assessor or internal audit. The output is a documented evidence calendar with a named owner for each artifact.

Open-source tools that produce MP-7 endpoint evidence

MP-7 turns on whether removable media can actually be restricted on endpoints, so the evidence has to come from configuration and endpoint state. The four tools below can each help show that a restriction exists, is enforced and is being checked, but each covers a different slice of that evidence. Treat them as sources of evidence for your own controls, not as proof that MP-7 is met.

Wazuh configuration assessment evidence

Wazuh Security Configuration Assessment scans monitored endpoints against YAML policies, most of them based on CIS benchmarks, and checks files, directories, registry keys and running processes. Its results include remediation recommendations. You can add custom policies that test for your own media restriction settings, such as a required device control configuration or a blocked storage driver. Confirm that your chosen policy checks the enforced setting rather than only the presence of a document. The license is GPL-2.0-only, so review how your distribution and any modifications are handled before you deploy it.

Fleet policy pass and fail reports

Fleet policies are yes or no questions asked of devices as osquery queries, and the policies page shows which devices in each fleet pass or fail. For MP-7, a policy can ask whether a prohibited media class is present or whether an approved configuration is in place, and the pass or fail history becomes dated evidence of the check. Confirm that the query tests what you need, since a policy that reads a setting is not the same as one that blocks a device. Fleet is MIT licensed, which simplifies redistribution inside your own environment.

osquery inventory of hardware and processes

osquery exposes running processes, hardware events and file hashes as SQL tables, and osqueryd schedules those queries across a fleet of hosts. Hardware event tables can show when a USB storage device was connected, which gives you a record that supports the prohibition of unidentified portable storage. Process tables can show whether an unauthorized media utility is running. Confirm which tables your operating systems populate, because hardware visibility differs by platform. osquery is licensed under Apache-2.0 OR GPL-2.0-only, so choose the license option that fits your use.

Velociraptor hunts for media artifacts

Velociraptor collects forensic artifacts defined in VQL from endpoints and runs hunts that gather one or more artifacts across a group of systems. Offline machines are scheduled to collect when they reconnect, and each hunt gets a notebook for analyzing combined results. This suits retrospective checks, such as finding every endpoint that recorded a device with no identifiable owner during a review period. It is a collection and investigation tool, so confirm that it can block or enforce a restriction in your environment before you rely on it for that purpose. The AGPL-3.0-only license imposes obligations if you modify and distribute the software or offer it over a network, so have counsel review it.

What meeting MP-7 costs in money and effort

This table breaks the cost of meeting MP-7 into components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. NIST does not estimate compliance costs, so no figures appear here; use the drivers to scope a written quote and compare like with like.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it up or down
Tooling and licenses	Software vendor or none for self-hosted open source; the organization still pays for hosting and staff time	Recurring if commercial support or hosting is bought; open-source licenses carry no fee	Number of endpoints and whether support contracts are needed; self-hosting removes license spend but not operating effort
Engineering time to define and configure media restrictions	Internal platform or endpoint teams, or an implementation partner under a fixed-scope agreement	One-time for the initial policy and configuration, then recurring for changes	Number of defined media types, number of systems in scope, and how many distinct restriction rules are needed per system
Endpoint management and device inventory	Internal IT operations; the cost is largely staff time to keep the device list accurate	Recurring	Fleet size, OS mix (Windows, macOS and Linux each need their own checks), and how many devices are unmanaged or BYOD
Policy and query authoring for ownership checks	Internal security engineering or a consultant preparing custom checks	One-time to build, recurring to maintain as platforms change	Number of portable storage rules that depend on an identifiable owner, and how often device ownership records change
Exception handling and approvals	Internal risk owners and service desk staff	Recurring	Exception volume, approval workflow maturity, and how often exceptions are reviewed and closed
Evidence upkeep	Internal compliance or security operations staff	Recurring, with each assessment cycle	Frequency of scans and reports, how many systems produce evidence, and whether evidence is collected automatically
External testing or review of restrictions	Independent testers or assessors, paid under a written scope	Recurring at each assessment or test cycle	Number of systems tested, depth of the test of mechanisms, and whether testers rely on existing evidence
Auditor sampling and assessment	The independent assessor or auditor, paid under their own engagement terms	Recurring at each assessment	Number of systems and devices sampled, sample size set by the assessor, and how cleanly evidence is organized

Where your team, a partner and the auditor each fit

Your organization owns MP-7. The control asks you to define which media types are restricted or prohibited, on which systems or components, and which controls enforce that decision. Those choices depend on your data, your operating environments and your tolerance for exceptions, so they cannot be delegated to a vendor or a partner. Your internal owners also decide what happens when a business need conflicts with a restriction.

Defined media types: Decide which classes of removable media (for example, USB mass storage, optical drives or external drives) are restricted, prohibited or allowed on each system.
Policy and rules of behavior: Maintain the system use policy and the rules of behavior that personnel acknowledge, since assessors examine both.
Exception decisions: Approve, record and periodically review any exception to a media restriction, with a named accountable owner.
Ownership of portable devices: Decide how you will identify the owner of each approved portable storage device, which is required before MP-7 can be met for devices without an identifiable owner.
Control accountability: Assign a control owner who answers assessor questions and signs off on the evidence.

Before any outside work starts, confirm internally that these decisions are written down and approved, because an implementation partner can only configure what you have defined.

Where MP-7 implementations usually fall short

MP-7 assessments tend to fail at the gap between a written policy and what systems actually allow. The cards below cover the places where that gap usually shows up, from unenforced media rules to evidence assembled only when an assessor asks. Each card names one gap and the action that closes it.

Policy names media nobody enforces

The media use policy lists permitted and prohibited device types, but no system setting, endpoint rule or check actually blocks them. An assessor testing MP-7 will ask for the mechanism that restricts use on each system, not only the document. Map every media type named in the policy to a specific control on each system class, and confirm that the policy and the configuration were reviewed together.

Unowned portable storage still accepted

MP-7 requires that portable storage devices with no identifiable owner be prohibited. In practice, unlabeled USB drives found at conferences or in shared desks are often plugged into workstations without anyone asking whose they are. Define how a device is tied to an owner, such as asset tags or registration, and configure systems to refuse devices that cannot be matched to one. Confirm the rule with the people who manage shared workstations.

Restrictions missing on part of the fleet

Media restrictions are often applied to laptops enrolled in the main management tool while older desktops, lab machines and servers stay outside it. An assessor sampling systems will find the gap quickly. Use a fleet query to report, for every enrolled and unenrolled endpoint, whether the media restriction is present, and treat unreported hosts as failing until they are checked.

Exceptions with no expiry or record

Teams often need a specific device, such as a forensic drive or a vendor's diagnostic tool, and get an informal exception that never expires and is never written down. Each exception should name the system, the device, the approver, the business reason and an end date, and it should be removed from the allowlist when that date passes. Ask for the exception register during any readiness review and check that every entry is still current.

Evidence collected once for the audit

Teams often run one scan or export screenshots of settings shortly before an assessment, then have nothing for the months in between. MP-7 is easier to defend when the same check runs on a schedule and its results are kept with dates. Set a recurring query or scan for media restrictions, retain the output, and record how failing results were fixed. Ask your implementation partner to show the history, not just the latest result.

Questions buyers ask about MP-7 before bringing in help

Is MP-7 more work than MP-2 for an organization?

Usually it is a different kind of work, and it is often less about paperwork and more about endpoints. MP-2 limits who can access media, so its evidence centers on access roles, custody records and physical controls. MP-7 limits which media can be used on systems, so the work sits on the device fleet: defining the media types in scope, configuring the systems that enforce the restriction, and proving that the restriction holds on each device. The effort rises with the number of endpoints, the number of operating system types, and how many systems are exempt or need exceptions. Ask the assessor which evidence they expect for each defined system before you size the work, because the answer changes how much fleet-level proof you need.

Can a small team implement MP-7 in-house?

A small team can often do it in-house if the device estate is small, uniform and already managed by a device management or endpoint tool. The work is mostly defining the media types and systems in scope, writing the restriction rule, applying it, and collecting evidence. It becomes harder when devices are unmanaged, when users hold local administrator rights, or when the same restriction must work across several operating systems. Be honest about capacity. Someone must own the policy, someone must operate the endpoint tooling, and someone must answer the assessor's questions. If one person holds all three roles, plan for their time being the constraint.

What does MP-7 need from endpoint and policy owners?

MP-7 depends on two groups working together. Policy owners must define which media types are restricted or prohibited, which systems or components the rule covers, and how exceptions are approved. Endpoint owners must turn that decision into configuration and prove it runs. Expect the policy owner to maintain the media use rules and rules of behavior, and the endpoint owner to keep configuration settings and their proof current. Both should agree on how unidentified portable storage devices are handled, because that prohibition is specific and easy to overlook. Written agreement between these owners is often the first evidence an assessor asks for.

How long does MP-7 work take?

The duration depends on the written scope and the fleet, and no figure applies to every organization. The main drivers are the number of defined systems, the number of device types and operating systems, whether devices are already under central management, how many exceptions need documented approval, and how quickly the assessor's evidence requests are answered. Ask any implementation partner for a timeline tied to a written scope that lists the systems, device types and deliverables. Ask your assessor when they need evidence and whether they want a sample walkthrough before final testing, since both affect the schedule.

What will an assessor sample for MP-7?

Assessors work from the assessment procedure for MP-7 in SP 800-53A, which uses examine, interview and test methods. In practice they usually examine the system use policy, procedures for media usage restrictions, rules of behavior and configuration settings, interview the people who manage media use and the system and network administrators, and test whether the restriction works on a selection of systems. For a sample, expect them to pick several devices or components and ask for proof that the restriction applies to each, plus evidence that unidentified portable storage is prohibited. Confirm the sample size, the systems selected and the format of evidence with your assessor before you collect anything.

Can a partner make the audit pass?

No partner can guarantee an assessment outcome, and no implementation partner can issue an assessment result. DeployOpen prepares systems, configuration and evidence for MP-7, and the organization owns its controls. An independent assessor or authorizing body decides whether the control is met. A well-scoped engagement can make the evidence clearer, consistent and easier to sample, but the result depends on the organization's real operation of the restriction, its exception handling and its records. Ask any partner to show how the evidence maps to the assessment procedure and to confirm the assessor's expectations early.

How DeployOpen scopes and prepares MP-7 evidence

DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure. For MP-7 Media use, we prepare the technical restrictions and the evidence an assessor examines, while the organization keeps ownership of its media use policy and the independent auditor issues any assessment conclusion.

How we scope

Agree in writing which systems and components fall under the MP-7 restrictions and which media types are defined as restricted or prohibited.
Confirm with the client who owns the system use policy, the rules of behavior and the procedures for media usage restrictions.
Record the scope, deliverables and timeline in a fixed-scope agreement before any configuration work begins.

How we build

Configure endpoint policies that check whether portable storage devices are permitted on each system, using defined device rules.
Write yes or no compliance queries for devices and report which hosts pass or fail each media use policy.
Test the restriction mechanisms on representative systems, including devices with no identifiable owner, and record the results.

How we hand over

Deliver a mapping of each MP-7 determination statement to the configuration settings, policy exports and test records that support it.
Provide the scan and query output in a form the client can retain and present during an assessment.
Document the procedures for operating, changing and reviewing media use restrictions so the client's own staff can run them.

How we support

Offer ongoing support, upgrades and continuous testing of media use controls as a retainer if the client wants it.
Review restriction policies when systems, device types or the client's media use rules change.
Confirm with the client's assessor which evidence formats and sampling they expect before the assessment starts.