MP – Media Protection

NIST SP 800-53 Rev. 5 – MP – Media Protection

1.Kravtext (engelskt original)#

MP-1 – Policy and Procedures#

a. Develop, document, and disseminate to [organization-defined personnel or roles]:
- 1. [organization-level or mission/business process-level or system-level] media protection policy that:
  - (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 1. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;
b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the media protection policy and procedures; and
c. Review and update the current media protection:
- 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
- 1. Procedures [organization-defined frequency] and following [organization-defined events].

MP-2 – Media Access#

Restrict access to [organization-defined types of digital and/or non-digital media] to [organization-defined personnel or roles].

MP-2(1) – Automated Restricted Access

MP-2(2) – Cryptographic Protection

MP-3 – Media Marking#

a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
b. Exempt [organization-defined types of media exempted from marking] from marking if the media remain within [organization-defined controlled areas].

MP-4 – Media Storage#

a. Physically control and securely store [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas] ; and
b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

MP-4(1) – Cryptographic Protection

MP-4(2) – Automated Restricted Access

Restrict access to media storage areas and log access attempts and access granted using [organization-defined automated mechanisms].

MP-5 – Media Transport#

a. Protect and control [organization-defined types of system media] during transport outside of controlled areas using [organization-defined controls];
b. Maintain accountability for system media during transport outside of controlled areas;
c. Document activities associated with the transport of system media; and
d. Restrict the activities associated with the transport of system media to authorized personnel.

MP-5(1) – Protection Outside of Controlled Areas

MP-5(2) – Documentation of Activities

MP-5(3) – Custodians

Employ an identified custodian during transport of system media outside of controlled areas.

MP-5(4) – Cryptographic Protection

MP-6 – Media Sanitization#

a. Sanitize [organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [organization-defined sanitization techniques and procedures] ; and
b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

MP-6(1) – Review, Approve, Track, Document, and Verify

Review, approve, track, document, and verify media sanitization and disposal actions.

MP-6(2) – Equipment Testing

Test sanitization equipment and procedures [organization-defined frequency] to ensure that the intended sanitization is being achieved.

MP-6(3) – Nondestructive Techniques

Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [organization-defined circumstances].

MP-6(4) – Controlled Unclassified Information

MP-6(5) – Classified Information

MP-6(6) – Media Destruction

MP-6(7) – Dual Authorization

Enforce dual authorization for the sanitization of [organization-defined system media].

MP-6(8) – Remote Purging or Wiping of Information

Provide the capability to purge or wipe information from [organization-defined systems or system components]remotely or under [organization-defined conditions] ].

MP-7 – Media Use#

a. [restrict or prohibit] the use of [organization-defined types of system media] on [organization-defined systems or system components] using [organization-defined controls] ; and
b. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

MP-7(1) – Prohibit Use Without Owner

MP-7(2) – Prohibit Use of Sanitization-resistant Media

Prohibit the use of sanitization-resistant media in organizational systems.

MP-8 – Media Downgrading#

a. Establish [organization-defined system media downgrading process] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;
b. Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;
c. Identify [organization-defined system media requiring downgrading] ; and
d. Downgrade the identified system media using the established process.

MP-8(1) – Documentation of Process

Document system media downgrading actions.

MP-8(2) – Equipment Testing

Test downgrading equipment and procedures [organization-defined frequency] to ensure that downgrading actions are being achieved.

MP-8(3) – Controlled Unclassified Information

Downgrade system media containing controlled unclassified information prior to public release.

MP-8(4) – Classified Information

Downgrade system media containing classified information prior to release to individuals without required access authorizations.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.