+MP Media Protection
---+MP-01 Policy and Procedures
---+MP-02 Media Access
---+MP-03 Media Marking
---+MP-04 Media Storage
------+MP-04(02) Automated Restricted Access
---+MP-05 Media Transport
------+MP-05(03) Custodians
---+MP-06 Media Sanitization
------+MP-06(01) Review, Approve, Track, Document, and Verify
------+MP-06(02) Equipment Testing
------+MP-06(03) Nondestructive Techniques
------+MP-06(07) Dual Authorization
------+MP-06(08) Remote Purging or Wiping of Information
---+MP-07 Media Use
------+MP-07(02) Prohibit Use of Sanitization-resistant Media
---+MP-08 Media Downgrading
------+MP-08(01) Documentation of Process
------+MP-08(02) Equipment Testing
------+MP-08(03) Controlled Unclassified Information
------+MP-08(04) Classified Information

MP Media Protection

Media Protection

1. Overzicht

MP-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the media protection policy and procedures; and
  3. Review and update the current media protection:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Media protection policy and procedures address the controls in the MP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of media protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to media protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a media protection policy is developed and documented;
    2. the media protection policy is disseminated to [Assignement: personnel or roles];
    3. media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;
    4. the media protection procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] media protection policy compliance;
      2. the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.
      1. the current media protection policy is reviewed and updated [Assignement: frequency];
      2. the current media protection policy is reviewed and updated following [Assignement: events];
      1. the current media protection procedures are reviewed and updated [Assignement: frequency];
      2. the current media protection procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Media protection policy and procedures organizational risk management strategy system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with media protection responsibilities organizational personnel with information security and privacy responsibilities
MP-02 Media Access

Control

Restrict access to [Assignement: organization-defined types of digital and/or non-digital media] to [Assignement: organization-defined personnel or roles].

Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.

Assessment Objective

  1. access to [Assignement: types of digital media] is restricted to [Assignement: personnel or roles];
  2. access to [Assignement: types of non-digital media] is restricted to [Assignement: personnel or roles].

Assessment Method

Examine

System media protection policy procedures addressing media access restrictions access control policy and procedures physical and environmental protection policy and procedures media storage facilities access control records system security plan other relevant documents or records

Interview

Organizational personnel with system media protection responsibilities organizational personnel with information security responsibilities system/network administrators
MP-03 Media Marking

Control

  1. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
  2. Exempt [Assignement: types of media exempted from marking] from marking if the media remain within [Assignement: controlled areas].

Discussion

Security marking refers to the application or use of human-readable security attributes. Digital media includes diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), flash drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Controlled unclassified information is defined by the National Archives and Records Administration along with the appropriate safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) . Security markings are generally not required for media that contains information determined by organizations to be in the public domain or to be publicly releasable. Some organizations may require markings for public information indicating that the information is publicly releasable. System media marking reflects applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.

Assessment Objective

  1. system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information;
  2. [Assignement: types of media exempted from marking] remain within [Assignement: controlled areas].

Assessment Method

Examine

System media protection policy procedures addressing media marking physical and environmental protection policy and procedures list of system media marking security attributes designated controlled areas system security plan other relevant documents or records

Interview

Organizational personnel with system media protection and marking responsibilities organizational personnel with information security responsibilities
MP-04 Media Storage

Control

  1. Physically control and securely store [Assignement: organization-defined types of digital and/or non-digital media] within [Assignement: organization-defined controlled areas] ; and
  2. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection.

Assessment Objective

    1. [Assignement: types of digital media] are physically controlled;
    2. [Assignement: types of non-digital media] are physically controlled;
    3. [Assignement: types of digital media] are securely stored within [Assignement: controlled areas];
    4. [Assignement: types of non-digital media] are securely stored within [Assignement: controlled areas];
  2. system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Assessment Method

Examine

System media protection policy procedures addressing media storage physical and environmental protection policy and procedures access control policy and procedures system media designated controlled areas system security plan other relevant documents or records

Interview

Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities
MP-05 Media Transport

Control

  1. Protect and control [Assignement: types of system media] during transport outside of controlled areas using [Assignement: organization-defined controls];
  2. Maintain accountability for system media during transport outside of controlled areas;
  3. Document activities associated with the transport of system media; and
  4. Restrict the activities associated with the transport of system media to authorized personnel.

Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs. Non-digital media includes microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural controls to meet requirements established for protecting information and systems. Controls to protect media during transport include cryptography and locked containers. Cryptographic mechanisms can provide confidentiality and integrity protections depending on the mechanisms implemented. Activities associated with media transport include releasing media for transport, ensuring that media enters the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking and/or obtaining records of transport activities as the media moves through the transportation system to prevent and detect loss, destruction, or tampering. Organizations establish documentation requirements for activities associated with the transport of system media in accordance with organizational assessments of risk. Organizations maintain the flexibility to define record-keeping methods for the different types of media transport as part of a system of transport-related records.

Assessment Objective

    1. [Assignement: types of system media] are protected during transport outside of controlled areas using [Assignement: controls];
    2. [Assignement: types of system media] are controlled during transport outside of controlled areas using [Assignement: controls];
  2. accountability for system media is maintained during transport outside of controlled areas;
  3. activities associated with the transport of system media are documented;
    1. personnel authorized to conduct media transport activities is/are identified;
    2. activities associated with the transport of system media are restricted to identified authorized personnel.

Assessment Method

Examine

System media protection policy procedures addressing media storage physical and environmental protection policy and procedures access control policy and procedures authorized personnel list system media designated controlled areas system security plan other relevant documents or records

Interview

Organizational personnel with system media protection and storage responsibilities organizational personnel with information security responsibilities system/network administrators
MP-06 Media Sanitization

Control

  1. Sanitize [Assignement: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignement: organization-defined sanitization techniques and procedures] ; and
  2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Discussion

Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.

Assessment Objective

    1. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to disposal;
    2. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to release from organizational control;
    3. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to release for reuse;
  2. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.

Assessment Method

Examine

System media protection policy procedures addressing media sanitization and disposal applicable federal standards and policies addressing media sanitization policy media sanitization records system audit records system design documentation records retention and disposition policy records retention and disposition procedures system configuration settings and associated documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with media sanitization responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
MP-07 Media Use

Control

  1. [Selection: restrict; prohibit] the use of [Assignement: types of system media] on [Assignement: systems or system components] using [Assignement: controls] ; and
  2. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Discussion

System media includes both digital and non-digital media. Digital media includes diskettes, magnetic tapes, flash drives, compact discs, digital versatile discs, and removable hard disk drives. Non-digital media includes paper and microfilm. Media use protections also apply to mobile devices with information storage capabilities. In contrast to [MP-2](#mp-2) , which restricts user access to media, MP-7 restricts the use of certain types of media on systems, for example, restricting or prohibiting the use of flash drives or external hard disk drives. Organizations use technical and nontechnical controls to restrict the use of system media. Organizations may restrict the use of portable storage devices, for example, by using physical cages on workstations to prohibit access to certain external ports or disabling or removing the ability to insert, read, or write to such devices. Organizations may also limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Finally, organizations may restrict the use of portable storage devices based on the type of device, such as by prohibiting the use of writeable, portable storage devices and implementing this restriction by disabling or removing the capability to write to such devices. Requiring identifiable owners for storage devices reduces the risk of using such devices by allowing organizations to assign responsibility for addressing known vulnerabilities in the devices.

Assessment Objective

  1. the use of [Assignement: types of system media] is [Selection: restrict; prohibit] on [Assignement: systems or system components] using [Assignement: controls];
  2. the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.

Assessment Method

Examine

System media protection policy system use policy procedures addressing media usage restrictions rules of behavior system design documentation system configuration settings and associated documentation audit records system security plan other relevant documents or records

Interview

Organizational personnel with system media use responsibilities organizational personnel with information security responsibilities system/network administrators
MP-08 Media Downgrading

Control

  1. Establish [Assignement: system media downgrading process] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;
  2. Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;
  3. Identify [Assignement: system media requiring downgrading] ; and
  4. Downgrade the identified system media using the established process.

Discussion

Media downgrading applies to digital and non-digital media subject to release outside of the organization, whether the media is considered removable or not. When applied to system media, the downgrading process removes information from the media, typically by security category or classification level, such that the information cannot be retrieved or reconstructed. Downgrading of media includes redacting information to enable wider release and distribution. Downgrading ensures that empty space on the media is devoid of information.

Assessment Objective

    1. a [Assignement: system media downgrading process] is established;
    2. the [Assignement: system media downgrading process] includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;
    1. there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed;
    2. there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information;
  3. [Assignement: system media requiring downgrading] is identified;
  4. the identified system media is downgraded using the [Assignement: system media downgrading process].

Assessment Method

Examine

System media protection policy procedures addressing media downgrading system categorization documentation list of media requiring downgrading records of media downgrading audit records system security plan other relevant documents or records

Interview

Organizational personnel with system media downgrading responsibilities organizational personnel with information security responsibilities system/network administrators

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen