Media Protection Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for media protection in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers the full lifecycle of media that holds the Organization’s information. Data loss through media is harder to detect than data loss over a network. The Organization must mark media and restrict access to it in proportion to its sensitivity. It must store and transport media with protection and accountability, and it must encrypt data at rest on removable media. Before disposal or reuse, it must sanitize media under NIST SP 800-88 and verify and document the destruction.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.DS — Data Security (Protect function)

These categories fall under the Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every media protection control in the moderate baseline of FIPS 200 and NIST SP 800-53B:

• MP-01 — Policy and Procedures
• MP-02 — Media Access
• MP-03 — Media Marking
• MP-04 — Media Storage
• MP-05 — Media Transport
• MP-06 — Media Sanitization
• MP-07 — Media Use

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1236: Electronic Records Management, current text.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MP control family. They add to the NIST SP 800-53 control requirements in the Policy section.

32 CFR Part 2002: Controlled Unclassified Information

• The organization must designate a CUI Senior Agency Official and Program Manager, mark and safeguard controlled unclassified information per the CUI Registry, apply the CUI requirements to information systems and to contractor agreements, and submit CUI program reports to the CUI Executive Agent (ISOO). (32 CFR Part 2002; ISOO Notice 2026-07)

NARA GRS 3.1: General Records Schedule 3.1: General Technology Management Records

• The organization must keep media sanitization records under NARA General Records Schedule 3.1, item 020, and destroy them only when that schedule allows. (NARA GRS 3.1, item 020)

NIST SP 800-88 Rev 2: Guidelines for Media Sanitization

• The organization should sanitize media using clear, purge, or destroy methods appropriate to the media type and the confidentiality of the information, verify the result, and keep a sanitization record — including at contract closeout for contractor-held media. (NIST SP 800-88 Rev 2)
• The organization should run a media sanitization program that selects sanitization and disposal techniques and controls based on the sensitivity of the information on the media. (NIST SP 800-88 Rev 2, Abstract and §2)

36 CFR Part 1236: Electronic Records Management

• The organization should when records must be kept longer than the system that holds them will last, plan their move to a new system or medium before that system is retired. (36 CFR 1236.14)

3. Policy #

The Organization must implement and maintain its media protection controls to meet the following requirements:

MP-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] media protection policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the media protection policy and procedures; and
3. Review and update the current media protection:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level media protection policy and the procedures that implement it, and must distribute both to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. Those same officials must manage the development, documentation, and distribution of the policy and the procedures. They must keep both documents consistent with applicable laws, directives, and standards. The policy must state its purpose and scope, assign roles and responsibilities, record management’s commitment, and set expectations for coordination and compliance. The designated officials must review and update the policy every 3 years and after a major change to applicable policy. They must review and update the procedures on the same cycle.

MP-02 — Media Access #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

Restrict access to [Assignment: organization-defined types of digital and/or non-digital media — to be defined] to [Assignment: organization-defined personnel or roles — to be defined].

Implementation guidance:

Only individuals whom the System Owner or the Information Owner has authorized may access digital or non-digital media that contains personally identifiable information (PII) or other Organization sensitive information. This covers drives, tapes, discs, and paper alike. The owner must record each authorization on an approved access control list. Possession of media by a person who is not on the list is unauthorized access, whatever the intent. Owners must keep their lists current and must remove individuals whose need has ended. Personnel must give up media access they no longer require instead of keeping it for convenience.

MP-03 — Media Marking #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
2. Exempt no removable media types from marking if the media remain within organization-defined security safeguards not applicable.

Implementation guidance:

Personnel must mark system media to show the distribution limitations, handling caveats, and security markings that apply to the information it carries. Personnel may leave media unmarked in only two cases. The first is information in the public domain or approved for public release. The second is a specific media or hardware type that the Chief Information Officer (CIO) or a designate has exempted. An exemption applies only while the media stays inside Organization-controlled or authorized facilities. When personnel find unmarked, non-exempt media that holds sensitive information, they must treat it as a deficiency and correct it on discovery.

MP-04 — Media Storage #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media — to be defined] within see additional FedRAMP requirements and guidance; and
2. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Implementation guidance:

Personnel must physically control all digital and non-digital media that contains PII or Controlled Unclassified Information and must store it securely within Organization-controlled or authorized facilities. Secure storage means locked storage or a controlled media area that matches the sensitivity of the contents. Protection must continue until the media is destroyed or sanitized with approved equipment, techniques, and procedures. At no point in its life may sensitive media sit without an owner or without protection. System Owners must maintain accountability for stored media. Personnel must return media to controlled storage when they finish using it.

MP-05 — Media Transport #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. Protect and control all media with sensitive information during transport outside of controlled areas using prior to leaving secure/controlled environment: for digital media, encryption in compliance with Federal requirements and utilizes FIPS validated or NSA approved cryptography (see SC-13.); for non-digital media, secured in locked container;
2. Maintain accountability for system media during transport outside of controlled areas;
3. Document activities associated with the transport of system media; and
4. Restrict the activities associated with the transport of system media to authorized personnel.

Implementation guidance:

Personnel must protect digital and non-digital media that carry PII or other sensitive Organization information whenever the media travel outside controlled areas. Personnel must encrypt digital media with a cryptographic module that holds an active Federal Information Processing Standards (FIPS) 140-3 validation. A module whose FIPS 140-2 certificate has moved to the historical list may stay in use only under a plan of action and milestones (POA&M) item. That item must carry a replacement date and the Authorizing Official’s risk acceptance. Personnel must also seal media in tamper-evident packaging. Authorized personnel may hand-carry media in a locked container, or ship it through a commercial carrier with tracking and a receipt. The person who arranges transport must keep accountability for the media throughout the trip and must document every transport activity. Only authorized personnel may carry or arrange transport. A loss of custody during transport is a reportable incident.

MP-06 — Media Sanitization #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

1. Sanitize techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures — to be defined]; and
2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Implementation guidance:

Personnel must sanitize digital and non-digital media before disposal, before release out of the Organization’s control, and before release for reuse. They must use approved techniques and procedures under NIST SP 800-88 Rev. 2. The strength of the method must match the security category or classification of the information on the media. Before anyone sanitizes or destroys media that holds federal records, the System Owner must confirm with the records officer that the records schedule allows disposal. A second person who did not do the work must validate each sanitization. Each record must name the final disposition of the media: reused internally, reused externally, returned, or destroyed. The System Owner must keep sanitization records for 3 years, as National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.1, item 020, requires. Before the Organization contracts out sanitization or destruction, the ISSO must document due diligence on the vendor, such as an independent audit or a third-party certification. The Contracting Officer keeps it in the contract file. When sanitization cannot be assured, personnel must destroy the media.

MP-07 — Media Use #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Requirement:

1. [Selection: restrict; prohibit — to be defined] the use of [Assignment: organization-defined types of system media — to be defined] on [Assignment: organization-defined systems or system components — to be defined] using [Assignment: organization-defined controls — to be defined]; and
2. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Implementation guidance:

On all workstations and mobile devices, personnel may use only Organization-approved flash drives and external hard disk drives as removable storage. Personnel must not connect personally owned media to Organization systems. No one may connect a portable storage device that has no identifiable owner; the Organization treats an ownerless drive as hostile. Anyone who needs removable media must request it through the approval workflow, so that every approved device has a named owner on record. System Owners must enforce these restrictions on their systems. Personnel who find media must hand it to the ISSO and must not test it.

Related Required Processes #

• At contract close-out, each contractor that held the Organization’s Controlled Unclassified Information (CUI) returns or destroys it under NIST SP 800-88 and signs a certificate. The steps are in the System and Services Acquisition procedure.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the POA&M process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of media protection controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves media protection through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate detection and policy enforcement for removable media use at the endpoint, with exceptions managed centrally.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1236: Electronic Records Management, current text.
• CUI Registry.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• Superseded source, kept for its history: FIPS 140-2: Security Requirements for Cryptographic Modules, May 25, 2001. Replaced by FIPS 140-3.
• FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
• NARA General Records Schedule 3.1: General Technology Management Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.