MP-8 Media downgrading: requirements and evidence

MP-8 media downgrading: the process your organization must prove before releasing media to lower-clearance recipients

MP-8 requires an established process for downgrading media, meaning removing information so the media can be released to recipients with lower access authorizations, using mechanisms whose strength matches the security category or classification of the information. The control also expects you to verify that the process suits both the information being removed and the recipients' authorizations, to identify the media that need downgrading, and to show that the media were actually put through the process. When a contract, a system categorization or an internal policy pulls MP-8 into scope, the question an assessor will ask is simple: can you show each step, with records, for every release to a lower audience?

The risk is information that looks removed but is not. A file moved to a shared drive, a drive handed to a partner, or a tape sent to a less cleared team may still hold data the recipient is not entitled to see, including metadata, residual content, or information in slack space. Because MP-8 is not allocated to the low, moderate or high baselines or to the privacy baseline in SP 800-53B, many teams never assign it an owner. The media protection policy and the sanitization procedures in MP-6 often stop at disposal, so nobody is clearly responsible for the downgrading path between the two. Confirm early whether your system's categorization, your contracts or your data owners require MP-8, and name a single accountable owner for it.

Practically, start with the inventory: which media, systems and repositories hold information that will ever move to a lower-authorized audience. Then confirm which downgrading mechanisms exist, how each was verified for the information it handles, and where the records of each downgrade are kept. Your MP-6 sanitization records and audit logs are useful inputs, but they do not replace a downgrading process. Also confirm with your contracting or compliance lead whether the requirement is a tailored addition to a baseline, which determines how the control is documented in your system security and privacy plan. An implementation partner can help build the process and test the mechanisms, but the organization must own the decisions, and only an independent assessor can give an assessment opinion.

Which systems and media fall under MP-8 when you add it

MP-8 is not in any SP 800-53B baseline, so it applies only when your tailoring adds it. The scope comes from your own system categorization, the classification of the information, and the access authorizations of the people who will receive released media. The cards below cover the decisions that define that scope.

Systems categorized above the release level

Start with the security categorization documentation. MP-8 matters for systems whose information carries a higher category or classification than the people who will eventually receive some of it. List each system that holds information which might later be released at a lower level, and record the category that drives the mechanism strength you need. A system categorized only at a level that never leaves its own authorization boundary has little reason to carry MP-8. Confirm this with the system owner and the authorizing official.

Digital media leaving the high-side environment

Identify the digital media that cross from a higher-authorization environment to a lower one: removable drives, optical discs, backup tapes, exported data sets and virtual media images. Inventory the media types and the workflows that move them. Each type needs a defined downgrading path, because a verified method for one medium may not work for another. Ask the system administrators which exports happen routinely and which happen only in incidents, since both can trigger the control.

Non-digital media and printed output

Printed reports, paper files, microfilm and annotated documents also leave controlled environments. MP-8 covers media in any form, so the list of media requiring downgrading should include paper that is reviewed, redacted or reclassified before release. Decide who is responsible for physically reviewing and marking these items, and where the records of each downgrading action are kept. Printing and copying workflows are often overlooked in scope discussions.

Recipients with lower access authorizations

The downgrading process must suit the recipients' access authorizations, so define who receives downgraded media and what they are authorized to see. Map each recipient group to the authorization it holds. A recipient group that changes often, such as contractors or partner agencies, needs its authorization checked at each release. Record which authorization each release was checked against, since assessors interview the personnel who make those decisions.

Third parties who receive downgraded media

When a vendor, auditor, service provider or cloud operator receives downgraded media, that transfer leaves your direct control. Define whether these parties are recipients under your downgrading process, and whether their agreements and handling requirements match the authorization level of the released information. Confirm the contract terms with counsel and your acquisition team. The scope should record each external recipient and the process that released media to them.

Tailoring decision and documented rationale

MP-8 is added through tailoring when risk or applicable requirements call for it, not inherited from a baseline. Record the tailoring decision in the system security and privacy plan, with the reason the control was supplemented and which systems it covers. Note that SP 800-53 Release 5.2.0 defines four active enhancements for MP-8, and decide which of them your scope needs. Ask your authorizing official or compliance lead to confirm the rationale before the assessment starts.

How an assessor tests MP-8 under SP 800-53A

This table walks through the six SP 800-53A Rev. 5 determination statements for MP-8, showing the assessment method, the object an assessor examines, interviews or tests, the evidence to prepare and where findings usually arise. Read each row as a test the organization should be able to pass before the assessor arrives.

Method	Assessment object	Evidence requested	Common finding
Examine	Procedures addressing media downgrading	Written downgrading procedure showing the process, approvals and the mechanisms it relies on	Procedure exists but does not name the mechanisms or the recipients' authorization checks
Examine	System categorization documentation	Security categorization showing the information classification that sets the required mechanism strength	Downgrading strength is not tied back to the categorization
Examine	List of media requiring downgrading	Current inventory of media identified for downgrading, with owners and status	List is missing, outdated or does not cover removable and non-digital media
Examine	Records of media downgrading and audit records	Downgrading logs showing dates, media, verifier, outcome and recipient authorization	Records are incomplete or cannot be linked to a specific medium
Interview	Personnel with media downgrading responsibilities and system or network administrators	Named roles, training evidence and walkthrough of how a medium moves through the process	Administrators perform the work without documented responsibility or verification steps
Test	Organizational processes for media downgrading and the mechanisms that support or implement them	Live demonstration of a downgrading run, verification output and mechanism configuration	Mechanism strength is not verified against the information being removed

Matching downgrading mechanisms to the security category

The strength of a downgrading mechanism must match the security category or classification of the information being removed from the media. MP-8 does not let an organization pick one downgrading method for everything and apply it across all media. The process has to be sized to the highest category the media holds, and the organization must be able to show that link. In practice, the first decision is to take the categorization documentation that already exists for the system (the security categorization under the Risk Management Framework, or the classification scheme that governs the data) and read off the impact level of the information that will be downgraded. Only then can someone say whether a mechanism is strong enough.

A process that works for low-sensitivity data may not suit higher categories. A simple overwrite or a manual review that is adequate for information with limited adverse effect could leave recoverable residues of information rated moderate or high. Higher categories also tend to bring stricter handling rules for who may perform the downgrade, how the output is reviewed, and how the result is recorded. Organizations often discover this gap when a team applies one procedure to every media type and then needs to release something from a higher-category system. The practical question to answer in advance is which categories the process covers, and which categories require a different mechanism or must be excluded from downgrading altogether.

Assessors test the link between categorization and mechanism by following the chain of documents. They start with the system categorization record and the list of media that require downgrading, then check that each item maps to a downgrading procedure whose mechanisms match its category. They look for verification evidence showing that the process fits both the information removed and the authorizations of the recipients, and they interview the personnel and administrators who perform the work. Gaps usually appear where the categorization is out of date or where the mechanism was chosen by habit rather than by category. Confirm with your assessor which verification records and test results they will expect, since the method and depth of that testing are set by the assessment plan and the authorizing organization, not by this page.

Implementing MP-8 step by step

This sequence turns MP-8 from a tailoring decision into a working downgrading process, with a named owner, a register of media, verified mechanisms and dated records that an assessor can examine and test.

Confirm MP-8 is required through tailoring
Start with the system's security categorization and the baseline selected under SP 800-53B. MP-8 is not allocated to the low, moderate or high baselines or to the privacy baseline, so it appears only when the organization adds it during tailoring because risk or an applicable requirement calls for it. The system security and privacy plan should record the decision, the reason for it and the accountable official. Done means the tailoring record names MP-8 and the reason it applies, or explicitly states that it does not apply and why.
Define the downgrading process and owner
Write the procedure that governs media downgrading. It should state the scope of information covered, the mechanisms permitted for each security category or classification, the approval steps and the role responsible for the process. Assign an owner who has authority over media handling and can stop a downgrade that does not meet the standard. The output is an approved procedure, tied to the MP-1 media protection policy, with a named owner and an approval date. Confirm with your information owners which classification rules govern recipients in your environment.
Build the register of media requiring downgrading
Inventory the media that hold information needing downgrade before release to a lower-authorized audience. Record each item's identifier, location, current security category, the information it holds, the intended recipients and their access authorizations. Include digital media such as drives and backup sets as well as non-digital media. The register is the list an assessor will examine, so it must be kept current and reviewed when new media enter scope. Done means every item has an owner, a category and a documented target audience.
Select and verify mechanisms for each category
For each category of media and information, choose a downgrading mechanism whose strength matches the security category or classification of the information being removed. Test each candidate on representative media, confirm that the removed information cannot be recovered at the level the procedure requires, and record the result. Where a commercial or open-source tool is used, record its version and configuration. The verification report should show the mechanism, the test performed, the outcome and the approver. Ask your independent assessor how they expect verification to be evidenced for your categories.
Run the process and record each downgrade
Execute the approved procedure on each item in the register, in the order the procedure defines. For every downgrade, create a record that identifies the media, the mechanism and version used, the operator, the reviewer, the date and the recipient authorization it was prepared for. Store these records with the audit records for the system, so that the chain from the register to the released media can be followed. A downgrade is complete only when its record is signed off and the register entry is updated.
Test the process against recipient authorizations
Check that each downgraded output actually matches the access authorizations of the people who will receive it. Sample completed downgrades, compare the content against the recipient's authorization and confirm that nothing above that level remains. Interview the system and network administrators and the personnel responsible for downgrading to confirm they follow the procedure as written. Record exceptions and the corrective action taken. This test is what shows the process works in practice, not only on paper.
Document review and keep the process current
Review the procedure, the register, the verification report and the sample results on a defined cycle and after any change to classification rules, mechanisms or systems. Record each review, its findings and the updates made. Feed significant findings into the plan of action and milestones where they represent weaknesses. The sequence is complete when the next review cycle has a documented owner and the evidence set is ready for an assessor, who will review it independently of the organization and any implementation partner.

Evidence that passes an MP-8 assessment

MP-8 assessments follow the determination statements in SP 800-53A, so the evidence set maps to what an assessor will examine, interview and test. The six artifacts below connect: the procedure defines the process, the categorization and media list define the scope, and the records and verification results prove the process ran as written.

Media downgrading procedure

This is the documented process for removing information from media so it can be released to recipients with lower access authorizations. It should name the mechanisms used, state how each mechanism's strength is matched to the security category or classification of the information, and define who approves a downgrade. Assessors examine this document first. Check that it is versioned, approved by the control owner, and reviewed on a defined cycle so it reflects the current tools and roles.

System categorization documentation

The categorization records the impact level and information types that determine how strong a downgrading mechanism must be. Without it, an assessor cannot confirm that the process fits the information being removed. Keep the categorization linked to the system security plan and update it whenever data types, system boundaries or classifications change. Confirm that the categorization and the downgrading procedure use the same security category labels.

List of media requiring downgrading

This inventory identifies which media hold information that must pass through the downgrading process before release. Each entry should record the media identifier, location, information owner and classification. Assessors compare this list against asset inventories and records of released media. Review it at a defined interval and whenever media are added, retired or reassigned, because a stale list is a common reason an assessment finding is raised.

Downgrading records

Each downgrade event should produce a dated record showing the media, the source and target classification, the mechanism used, the approving official and the person who performed the work. These records prove the process was applied to the media on the list. Store them in a system that cannot be altered by the people who perform downgrades, and reconcile them against the media list each review cycle.

Audit records of downgrading activity

Audit records capture system events tied to downgrading, such as access to the downgrading tool, approvals, failed attempts and changes to mechanism settings. They show who did what and when, which lets an assessor test whether the process was followed in practice. Confirm that logging covers the systems that perform downgrading and that log review is scheduled, since assessors ask for evidence of review, not only retention.

Verification results

Verification shows that a downgrading process removed the information it was meant to remove and suits the recipients' access authorizations. Keep the test plan, the method used, the tester, the date and the outcome for each verification run. When a mechanism or tool changes, repeat verification and record the result. Confirm that verification is performed by someone independent of the person who performed the downgrade.

What meeting MP-8 costs in money and effort

MP-8 has no single price tag. Its cost is the sum of several distinct pieces of work, and each is paid to a different party. The organization owns the downgrading decision and the accountability for it. Staff and internal reviewers supply the business and security judgment. External parties may be paid for process design, testing support or tooling. Assessors do not design controls. An independent auditor is paid only to test what you already run and to sample your records. The main components are:

Process design: writing the downgrading process, defining the mechanisms it uses and mapping them to the security categories or classifications in scope.
Verification and testing: confirming that each mechanism suits the information being removed and the recipients' authorizations, then retesting after changes.
Mechanism tooling: the software or hardware that performs the removal, plus the licenses, support and hosting that come with it.
Staff time per downgrade: identifying media, running the process, checking the result and handling exceptions.
Record keeping and auditor sampling: keeping the list of media, downgrading records and audit records that assessors examine.

Ask the provider to price each component separately so you can see which parts are one-time and which recur.

Confirm with your assessor which records and sample sizes they expect before you size the record-keeping effort.

Where MP-8 usually fails and how to close each gap

MP-8 is rarely failed on paper. It fails because nobody owns the downgrading process, the control was never tailored in, or the records that prove a downgrade happened do not exist. The cards below pair each gap with a practical fix you can check before an assessor arrives.

No named owner for downgrading

MP-8 asks for an established process, and a process without an accountable owner tends to get performed informally by whoever holds the media. Name one role for the downgrading process and give it authority over the mechanisms, the list of media and the approval of each release. Assessors interview the people with media downgrading responsibilities, so the named role should be able to describe the process without reading it from a document. Confirm the role appears in your media protection policy and procedures.

MP-8 never added during tailoring

SP 800-53B does not allocate MP-8 to the low, moderate, high or privacy baselines, so it drops out of a baseline-only control set without anyone deciding that. Record the tailoring decision in the system security and privacy plan, either supplementing the baseline with MP-8 or documenting why risk or applicable requirements do not call for it. An assessor will check whether the system categorization supports that decision, so keep the two documents consistent.

Mechanisms not matched to categories

A downgrading mechanism has to be strong enough for the security category or classification of the information it removes. Teams often reuse a general-purpose export or redaction tool that was chosen for convenience, then find it cannot demonstrate that removed content is gone. Map each media type and information category to a defined mechanism, record why it is sufficient, and test it on representative samples. Ask your vendor or tool owner to state exactly what the mechanism removes and what it leaves behind.

No verification against recipient authorizations

Before media leaves a higher access level, the downgrade must be checked against the access authorizations of the intended recipients. Gaps appear when the release decision is made by the sender alone, or when recipient lists change and nobody re-verifies the clearance. Build a verification step into the downgrade workflow that compares the information's category with the recipients' documented authorizations and records who approved the release. Test the step with a recipient who should be refused.

Missing downgrade records

Assessors examine records of media downgrading and the related audit records, so an undocumented downgrade is treated as one that did not happen. Keep a log for each action that captures the media identifier, the source category, the mechanism used, the verification outcome, the approver and the recipient. Store the log where the media inventory is maintained, and check that audit logging covers the tool or system that performs the downgrade. Review a sample of entries each quarter to confirm they are complete.

Media list never reconciled

MP-8 requires identification of the media that need downgrading, and a list that was written once and never updated misses new devices, archived tapes and copies made during projects. Reconcile the downgrading list against the media inventory used for storage and sanitization, and assign each item a status. Confirm that media leaving the controlled area for downgrading is tracked under the transport and storage controls that already apply to it.

MP-8 media downgrading questions buyers ask

Is MP-8 media downgrading in the low, moderate or high baseline?

No. SP 800-53B does not allocate MP-8 to the low, moderate or high baselines or to the privacy baseline. An organization adds MP-8 by supplementing a baseline during tailoring, usually because its risk assessment or an applicable requirement calls for a downgrading process. Ask your contract owner or authorizing official whether any requirement in your environment names MP-8 explicitly, because that requirement, not the baseline, will decide whether you must implement it. Also note that SP 800-53 Release 5.2.0 defines four active enhancements for MP-8, and none of them is allocated to a baseline either.

How long does implementing MP-8 take and what drives the effort?

No public NIST source gives a duration for MP-8, so treat any figure you receive as a question for the vendor or partner to justify in writing. Effort depends mainly on how many media types and security categories fall under the downgrading process, how many distinct recipient access levels exist, whether downgrading is a rare event or a routine workflow, and how much existing sanitization tooling can be reused. Ask for the work to be broken into the process definition, the verification method, the list of media in scope and the records template, each with its own dependencies. Scope agreed in writing before work starts is the practical way to control the timeline.

Can our own team implement MP-8 without an outside partner?

Often yes, if your security and records staff already run media sanitization and classification processes. MP-8 asks for an established process, mechanisms matched to the security category, verification that the process suits the information and recipients, an inventory of media that need downgrading, and records of each downgrade. The difficult part is usually verification: someone independent of the people doing the downgrade must confirm the result, and that confirmation must be testable. An outside partner adds the most value where your team lacks test capacity, needs the process built into existing systems, or wants an independent review before an assessor arrives. Assessors do not accept a partner's paperwork as their own conclusion.

What does a partner need from our organization to start?

A partner needs decisions and records that only your organization can supply. Expect requests for your system security categorization, the classification scheme and the recipient access authorization levels, a list of media types in your environment, the current sanitization and release procedures, and the names of the people who will own and approve downgrading. The partner also needs access to the systems and tools that will produce the downgrade records and audit trail, plus a named internal owner who can make scope and risk decisions. Missing categorization or unclear recipient levels are the most common causes of rework, so resolve them before the scope is fixed.

How does MP-8 relate to MP-6 media sanitization?

MP-6 covers sanitizing media before disposal, release out of organizational control or reuse. MP-8 covers removing information so media can be released to recipients with lower access authorizations, which means the media stays in use or circulation within a defined chain. The two share mechanisms and verification thinking, so an organization that already has strong MP-6 sanitization records can often reuse that tooling and evidence format for MP-8. The key difference is the recipient: MP-8 requires that the downgrading process be checked against the access levels of the people who will receive the media. Keep the two procedures separate in your documentation so an assessor can trace each one to its control.

What will an auditor ask to see for MP-8?

SP 800-53A Rev. 5 assesses MP-8 through six determination statements, using examine, interview and test methods. Expect to produce the media protection procedures that address downgrading, the system categorization documentation, the list of media requiring downgrading, records of each downgrade and related audit records. Assessors will interview personnel with downgrading responsibilities and system or network administrators, and they may test the downgrading process and the mechanisms that implement it. Assessment objects are suggestions, so your assessor may ask for more or different evidence. Confirm the assessment plan with your assessor early, and note that DeployOpen prepares evidence but does not issue assessment reports.

Which open-source tooling can produce MP-8 evidence?

No single open-source product is the answer to MP-8, and no tool should be treated as sufficient on its own. Evidence comes from a combination of a documented process, a media inventory, consistent logging of each downgrade and verification results. Self-hosted systems inside your own infrastructure can hold the inventory, workflow approvals and logs, while the verification step depends on the media and mechanisms you choose. Ask any candidate partner to show exactly which records each tool produces, where they are stored, how they are protected from change and whether they stay within your environment. Confirm each capability against the tool's own documentation before committing to it.

How DeployOpen prepares MP-8 processes and evidence

DeployOpen starts with a written scope that names the systems, media types and recipient classes covered by MP-8 downgrading. The scope is agreed before work begins, and it should state which information categories and classifications the downgrading process must handle, and which lower-access recipients will receive released material. Because no SP 800-53B baseline allocates MP-8, the organization first has to decide whether a risk assessment or an applicable requirement calls for the control and records that decision in its tailoring documentation. DeployOpen then works with the organization to define the process itself on the organization's own infrastructure: how media requiring downgrading are identified, which downgrading mechanisms are approved for each category, who may authorize a downgrade, and how the process is checked against the information and the recipients' access authorizations.

Once the process is defined, the work shifts to testing and records. DeployOpen helps the organization exercise the downgrading mechanisms on its own systems and capture the results, so that the verification the control requires is backed by observed behavior rather than by a description alone. The records assessors typically examine include the procedure itself, the system categorization documentation, the list of media requiring downgrading, the downgrading records and the related audit records. DeployOpen prepares these artifacts and maps them to the six MP-8 determination statements in SP 800-53A, so the organization can see where each statement is covered and where gaps remain. Interviews with the personnel who hold downgrading responsibilities will be part of the assessment, so those people should be named and briefed in advance. The organization should confirm the current assessment procedure text in the NIST CPRT catalog before finalizing the evidence set.

DeployOpen does not issue audit reports, attestations or certifications. An independent assessor or authorizing body reaches those conclusions, and the organization owns its controls, its risk decisions and its downgrading authorizations. Before engaging DeployOpen, the organization should ask for a written scope, a list of deliverables, the evidence each deliverable produces and the handoff format for the assessor. It should also confirm with its assessor which evidence the assessor expects and whether the assessor will test the mechanisms directly. The work is typically fixed-scope, and any ongoing testing of downgrading mechanisms after an assessment is a separate retainer decision that should be recorded in the same written agreement.

MP-8 Media downgrading