03.08 Media Protection

Statement

Physically control and securely store system media that contain CUI.

Guidance

System media include digital and non-digital media. Digital media include diskettes, flash drives, magnetic tapes, external or removable solid state or magnetic drives, compact discs, and digital versatile discs. Non-digital media include paper and microfilm. Physically controlling stored media includes conducting inventories, establishing procedures to allow individuals to check out and return media to libraries, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. Controlled areas provide physical and procedural controls to meet the requirements established for protecting information and systems. Sanitization techniques (e.g., destroying, cryptographically erasing, clearing, and purging) prevent the disclosure of CUI to unauthorized individuals. The sanitization process removes CUI from media such that the information cannot be retrieved or reconstructed.

Assessment objective

system media that contain CUI are physically controlled.

Assessment objective

system media that contain CUI are securely stored.

Assessment method

• physical protection policy and procedures media protection policy and procedures procedures for media storage access control policy and procedures system media system security plan other relevant documents or records

Assessment method

• personnel with system media protection and storage responsibilities personnel with information security responsibilities

Assessment method

• processes for storing information media mechanisms for supporting or implementing secure media storage/media protection

Statement

Restrict access to CUI on system media to authorized personnel or roles.

Guidance

System media include digital and non-digital media. Access to CUI on system media can be restricted by physically controlling such media. This includes conducting inventories, ensuring that procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for stored media. For digital media, access to CUI can be restricted by using cryptographic means. Encrypting data in storage or at rest is addressed in [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.08) 03.13.08.

Assessment objective

access to CUI on system media is restricted to authorized personnel or roles.

Assessment method

• physical protection policy and procedures media protection policy and procedures procedures for media access restrictions access control policy and procedures media storage facilities access control records system security plan other relevant documents or records

Assessment method

• personnel with system media protection responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for restricting information on media mechanisms for supporting or implementing media access restrictions

Statement

Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.

Guidance

Media sanitization applies to digital and non-digital media that are subject to disposal or reuse, whether or not the media are considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, mobile devices, workstations, network components, and non-digital media. The sanitization process removes CUI from media such that the information cannot be retrieved or reconstructed. Sanitization techniques (e.g., cryptographically erasing, clearing, purging, and destroying) prevent the disclosure of CUI to unauthorized individuals when such media are reused or released for disposal. NARA policies control the sanitization process for media that contain CUI and may require destruction when other methods cannot be applied to the media.

Assessment objective

system media that contain CUI are sanitized prior to disposal, release out of organizational control, or release for reuse.

Assessment method

• media protection policy and procedures procedures for media sanitization and disposal applicable standards and policies that address media sanitization policy system audit records media sanitization records system design documentation system configuration settings records retention and disposition policy records retention and disposition procedures system security plan other relevant documents or records

Assessment method

• personnel with media sanitization responsibilities personnel with records retention and disposition responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for media sanitization mechanisms for supporting or implementing media sanitization

Statement

Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings.

Guidance

System media include digital and non-digital media. Marking refers to the use or application of human-readable security attributes. Labeling refers to the use of security attributes for internal system data structures. Digital media include diskettes, magnetic tapes, external or removable solid state or magnetic drives, flash drives, compact discs, and digital versatile discs. Non-digital media include paper and microfilm. CUI is defined by NARA along with marking, safeguarding, and dissemination requirements for such information.

Assessment objective

system media that contain CUI are marked to indicate distribution limitations.

Assessment objective

system media that contain CUI are marked to indicate handling caveats.

Assessment objective

system media that contain CUI are marked to indicate applicable CUI markings.

Assessment method

• physical protection policy and procedures media protection policy and procedures procedures for media marking list of system media marking security attributes system security plan other relevant documents or records

Assessment method

• personnel with system media protection and marking responsibilities personnel with information security responsibilities

Assessment method

• processes for marking information media mechanisms for supporting or implementing media marking

Statement

• a. Protect and control system media that contain CUI during transport outside of controlled areas.

• b. Maintain accountability of system media that contain CUI during transport outside of controlled areas.

• c. Document activities associated with the transport of system media that contain CUI.

Guidance

System media include digital and non-digital media. Digital media include flash drives, diskettes, magnetic tapes, external or removable solid state or magnetic drives, compact discs, and digital versatile discs. Non-digital media include microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural measures to meet the requirements established for protecting CUI and systems. Media protection during transport can include cryptography and/or locked containers. Activities associated with media transport include releasing media for transport, ensuring that media enter the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking or obtaining the records of transport activities as the media move through the transportation system to prevent and detect loss, destruction, or tampering. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.08)03.13.08 and [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.11) 03.13.11.

Assessment objective

system media that contain CUI are protected during transport outside of controlled areas.

Assessment objective

system media that contain CUI are controlled during transport outside of controlled areas.

Assessment objective

activities associated with the transport of system media that contain CUI are documented.

Assessment objective

accountability for system media that contain CUI is maintained during transport outside of controlled areas.

Assessment method

• physical protection policy and procedures media protection policy and procedures procedures for media storage access control policy and procedures authorized personnel list system media designated controlled areas system and communications protection policy and procedures cryptographic mechanisms and configuration documentation procedures for the protection of information at rest system design documentation system configuration settings list of information at rest requiring confidentiality protections system audit records system security plan other relevant documents or records

Assessment method

• personnel with system media protection and storage responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• processes for storing information media mechanisms for supporting or implementing media storage/media protection mechanisms for supporting or implementing confidentiality protections for information at rest

Statement

• a. Restrict or prohibit the use of {{ insert: param, A.03.08.07.ODP.01 }}.

• b. Prohibit the use of removable system media without an identifiable owner.

Guidance

In contrast to requirement [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.08.01)03.08.01, which restricts user access to media, this requirement restricts or prohibits the use of certain types of media, such as external hard drives, flash drives, or smart displays. Organizations can use technical and non-technical measures (e.g., policies, procedures, and rules of behavior) to control the use of system media. For example, organizations may control the use of portable storage devices by using physical cages on workstations to prohibit access to external ports or disabling or removing the ability to insert, read, or write to devices. Organizations may limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Organizations may also control the use of portable storage devices based on the type of device — prohibiting the use of writeable, portable devices — and implement this restriction by disabling or removing the capability to write to such devices. Limits on the use of organization-controlled system media in external systems include restrictions on how the media may be used and under what conditions. Requiring identifiable owners (e.g., individuals, organizations, or projects) for removable system media reduces the risk of using such technologies by allowing organizations to assign responsibility and accountability for addressing known vulnerabilities in the media (e.g., insertion of malicious code).

Assessment objective

the use of the following types of system media is restricted or prohibited: {{ insert: param, A.03.08.07.ODP.01 }}.

Assessment objective

the use of removable system media without an identifiable owner is prohibited.

Assessment method

• system media protection policy and procedures system use policy procedures for media usage restrictions rules of behavior system audit records system design documentation system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with system media use responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for media use mechanisms for restricting or prohibiting the use of system media on systems or system components

Statement

• a. Protect the confidentiality of backup information.

• b. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations.

Guidance

The selection of cryptographic mechanisms is based on the need to protect the confidentiality of backup information. Hardware security module (HSM) devices safeguard and manage cryptographic keys and provide cryptographic processing. Cryptographic operations (e.g., encryption, decryption, and signature generation and verification) are typically hosted on the HSM device, and many implementations provide hardware-accelerated mechanisms for cryptographic operations. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.13.11) 03.13.11.

Assessment objective

cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI at backup storage locations.

Assessment objective

the confidentiality of backup information is protected.

Assessment method

• contingency planning policy and procedures procedures for system backup contingency plan system design documentation system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with system backup responsibilities personnel with information security responsibilities

Assessment method

• mechanisms for supporting or implementing the cryptographic protection of backup information