Assessment Objective

Determine if:

• MP-04a.
  • MP-04a.[01] [Assignment: types of digital media] are physically controlled;
  • MP-04a.[02] [Assignment: types of non-digital media] are physically controlled;
  • MP-04a.[03] [Assignment: types of digital media] are securely stored within [Assignment: controlled areas];
  • MP-04a.[04] [Assignment: types of non-digital media] are securely stored within [Assignment: controlled areas];
• MP-04b. system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Assessment Methods

Examine

• System media protection policy
• procedures addressing media storage
• physical and environmental protection policy and procedures
• access control policy and procedures
• system media
• designated controlled areas
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system media protection and storage responsibilities
• organizational personnel with information security responsibilities

Test

• Organizational processes for storing information media
• mechanisms supporting and/or implementing secure media storage/media protection

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final