+MP-04 Media Storage
---+MP-04(02) Automated Restricted Access

MP-04 Media Storage

Control

  1. Physically control and securely store [Assignement: organization-defined types of digital and/or non-digital media] within [Assignement: organization-defined controlled areas] ; and
  2. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection.

Assessment Objective

    1. [Assignement: types of digital media] are physically controlled;
    2. [Assignement: types of non-digital media] are physically controlled;
    3. [Assignement: types of digital media] are securely stored within [Assignement: controlled areas];
    4. [Assignement: types of non-digital media] are securely stored within [Assignement: controlled areas];
  2. system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Assessment Method

Examine

System media protection policy procedures addressing media storage physical and environmental protection policy and procedures access control policy and procedures system media designated controlled areas system security plan other relevant documents or records

Interview

Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities

1. Преглед

MP-04(02) Automated Restricted Access

Control

Restrict access to media storage areas and log access attempts and access granted using [Assignement: organization-defined automated mechanisms].

Discussion

Automated mechanisms include keypads, biometric readers, or card readers on the external entries to media storage areas.

Assessment Objective

  1. access to media storage areas is restricted using [Assignement: automated mechanisms];
  2. access attempts to media storage areas are logged using [Assignement: automated mechanisms];
  3. access granted to media storage areas is logged using [Assignement: automated mechanisms].

Assessment Method

Examine

System media protection policy procedures addressing media storage access control policy and procedures physical and environmental protection policy and procedures system design documentation system configuration settings and associated documentation media storage facilities access control devices access control records audit records system security plan other relevant documents or records

Interview

Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities system/network administrators

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации

Свързани задачи

Връзки
is blocked by MP-04 Media Storage – Assessment Procedure
is blocked by Media Storage