Media Protection Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the MP control family policy (POL-MP). It covers every control in the media protection family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the MP family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the high security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.DS — Data Security (Protect function)

3. Controls Covered #

This procedure covers the following 10 controls in the MP family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MP control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

32 CFR Part 2002: Controlled Unclassified Information

• The organization must designate a CUI Senior Agency Official and Program Manager, mark and safeguard controlled unclassified information per the CUI Registry, apply the CUI requirements to information systems and to contractor agreements, and submit CUI program reports to the CUI Executive Agent (ISOO). (32 CFR Part 2002; ISOO Notice 2026-07)

NARA GRS 3.1: General Records Schedule 3.1: General Technology Management Records

• The organization must keep media sanitization records under NARA General Records Schedule 3.1, item 020, and destroy them only when that schedule allows. (NARA GRS 3.1, item 020)

NIST SP 800-88 Rev 2: Guidelines for Media Sanitization

• The organization should sanitize media using clear, purge, or destroy methods appropriate to the media type and the confidentiality of the information, verify the result, and keep a sanitization record — including at contract closeout for contractor-held media. (NIST SP 800-88 Rev 2)
• The organization should run a media sanitization program that selects sanitization and disposal techniques and controls based on the sensitivity of the information on the media. (NIST SP 800-88 Rev 2, Abstract and §2)

36 CFR Part 1236: Electronic Records Management

• The organization should when records must be kept longer than the system that holds them will last, plan their move to a new system or medium before that system is retired. (36 CFR 1236.14)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the MP controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Media Protection family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Information System Security Officer (ISSO) / Media Protection Officer carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the MP policy (POL-MP) for the role definitions.

4.2 Control-Specific Procedures #

MP-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] media protection policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the media protection policy and procedures; and
3. Review and update the current media protection:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The designated officials, meaning the Authorizing Official, System Owners, ISSOs, and key stakeholders, manage the review cycle for POL-MP and PROC-MP. They open a revision every year, and sooner when a major change to applicable policy requires it. They collect input from the people who create, store, move, and destroy media every day, because that is where media protection fails.

The designated officials send the draft to stakeholders for comment. They decide each comment and record the approval before they publish the documents to the policy library. They send a distribution notice to every named role. The review record in the document management system holds the dates for the whole cycle.

Evidence: the version histories of both documents, the decided comments, the approval records, the distribution notices, and the review record.

MP-02 — Media Access #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Restrict access to [Assignment: organization-defined types of digital and/or non-digital media — to be defined] to [Assignment: organization-defined personnel or roles — to be defined].

Procedure:

The System Owner or the Information Owner authorizes each individual by name on the access control list for the media. Only listed individuals retrieve, view, or handle the media. Requesters submit access requests in the ticketing system, and the owner decides them there, so the authorization trail is a record in the system and not a person’s memory. When a person’s duties change or the person leaves, the owner removes the entry and records the removal the same way.

Owners reconcile their lists against the people who have handled the media. The owner refers any unexplained handling to the ISSO as a potential incident. Non-digital media follows the same rules: the list controls access to the file room as firmly as it controls access to the media safe.

Evidence: the access control lists with their authorization entries, the request and removal tickets, the reconciliation records, and any ISSO referrals.

MP-03 — Media Marking #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

1. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
2. Exempt no removable media types from marking if the media remain within organization-defined security safeguards not applicable.

Procedure:

Whoever creates or receives sensitive media applies the marking at creation or receipt. The marking shows the distribution limits, handling caveats, and applicable security markings, on the media itself or on its container when direct marking is impractical. A person who requests an exemption names the media or hardware type, and the Chief Information Officer (CIO) or a designate decides the request in the ticketing system. Exempted media stays inside Organization-controlled or authorized facilities, and the holder marks it before any authorized departure.

Anyone who finds unmarked sensitive media in circulation reports it. The holder marks it and traces it to the process that let it out, and the correction gets a ticket. The ISSO spot-checks marking practice during facility reviews.

Evidence: the exemption decisions, the correction tickets, and the spot-check records.

MP-04 — Media Storage #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

1. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media — to be defined] within see additional FedRAMP requirements and guidance; and
2. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Procedure:

System Owners keep sensitive media in locked storage inside Organization-controlled or authorized facilities. The System Owner keeps an accountability record that shows what the storage holds, where each item is, and who is responsible for it. Personnel log each check-out and return so that custody stays continuous. The System Owner runs inventories that reconcile the record against the shelf.

The System Owner reports any discrepancy to the ISSO, and the ISSO investigates it through a ticketing system incident. The ISSO treats a missing item as a potential incident until someone locates it. Media that leaves storage for destruction or sanitization moves under the same custody record until the approved process completes. The System Owner then writes the disposition back to the record.

Evidence: the accountability records, the check-out and return logs, the inventory reconciliations, the discrepancy tickets, and the disposition records.

MP-05 — Media Transport #

Baselines: Moderate / High CSF 2.0: PR.DS (Data Security)

1. Protect and control all media with sensitive information during transport outside of controlled areas using prior to leaving secure/controlled environment: for digital media, encryption in compliance with Federal requirements and utilizes FIPS validated or NSA approved cryptography (see SC-13.); for non-digital media, secured in locked container;
2. Maintain accountability for system media during transport outside of controlled areas;
3. Document activities associated with the transport of system media; and
4. Restrict the activities associated with the transport of system media to authorized personnel.

Procedure:

Transport starts with a documented request that states what media will move, its sensitivity, who will carry it, and which approved protection applies. The releasing custodian encrypts digital media with a module that holds an active Federal Information Processing Standards (FIPS) 140-3 validation and seals the media in tamper-evident packaging. An authorized person then carries it in a locked container, or the custodian ships it by a commercial carrier with tracking and receipt confirmation. The releasing custodian records the handoff, the method, and the expected arrival. The receiving party confirms receipt. A ticketing system record holds the whole round trip.

If a shipment misses its window or arrives with disturbed packaging, the custodian reports it to the ISSO immediately, and the ISSO handles it as a potential incident.

Evidence: the transport requests and records with release and receipt confirmations, the carrier tracking, and the exception reports.

MP-06 — Media Sanitization #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

1. Sanitize techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures — to be defined]; and
2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Procedure:

Media that reaches the end of its use enters the sanitization queue under its custody record. If the media holds federal records, the System Owner first confirms with the records officer that the records schedule allows disposal. The handler selects the NIST SP 800-88 Rev. 2 technique that fits the media type and the security category of the information: clear, purge, or destroy. The handler performs the technique or arranges it, and destroys media that cannot be sanitized reliably. A validator who did not do the work then checks the result. The handler records each action in the ticketing system: the media identifier, the technique, the date, the person performing, the person validating, and the final disposition. The System Owner keeps the record for 3 years under National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.1, item 020.

Before a contract for sanitization or destruction starts, the ISSO documents due diligence on the vendor, such as an independent audit or a third-party certification. The ISSO sends it to the Contracting Officer, who keeps it in the contract file. The handler keeps the vendor’s destruction certificates with the records they support. The ISSO samples completed sanitizations to confirm the technique selection and the record quality.

Evidence: the sanitization and destruction records with validator and final disposition, the records schedule confirmations, vendor due diligence files, vendor certificates, and the ISSO’s sampling results.

MP-06(1) — Review, Approve, Track, Document, and Verify #

Baselines: High

Review, approve, track, document, and verify media sanitization and disposal actions.

Procedure:

A media owner submits a sanitization or disposal request that lists the media type, serial number, and data sensitivity. The System Owner reviews the request, confirms the method, and approves it.

A technician performs the sanitization and records the method, date, and outcome. A second staff member checks the result before the media leaves organizational control. For contractor-held media, the contracting officer’s representative collects the contractor’s sanitization record at contract closeout.

The ISSO tracks open requests until each one has a verified record.

Evidence: approved requests, signed sanitization records with verification, and contractor closeout sanitization records.

MP-06(2) — Equipment Testing #

Baselines: High

Test sanitization equipment and procedures at least every six (6) months to ensure that the intended sanitization is being achieved.

Procedure:

The ISSO schedules equipment and procedure tests and assigns a technician for each. The technician sanitizes sample media with each device and method in service. The technician then attempts to recover data from the samples to confirm the result.

The technician records the device, method, sample media, and outcome. When a device fails, the ISSO tags it out of service until repair and a passing retest. When a procedure fails, the ISSO updates it and reruns the test.

Evidence: test records for each device and procedure, failure notices, and retest results.

MP-06(3) — Nondestructive Techniques #

Baselines: High

Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [Assignment: organization-defined circumstances — to be defined].

Procedure:

When a user needs to connect a portable storage device, the user brings it to the designated technician. The technician sanitizes the device with the method the ISSO approved for that device type. The technician confirms the device is empty and still works.

The technician records the device serial number, method, date, and result, then releases the device to the user. The ISSO reviews the records to confirm that staff sanitize devices before they connect them.

Evidence: sanitization records for each portable device and the ISSO’s review notes.

MP-07 — Media Use #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

1. [Selection: restrict; prohibit — to be defined] the use of [Assignment: organization-defined types of system media — to be defined] on [Assignment: organization-defined systems or system components — to be defined] using [Assignment: organization-defined controls — to be defined]; and
2. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Procedure:

A person who needs an approved flash drive or external hard disk drive submits a ticketing system request, and the request records the device and its named owner. Personnel use only issued devices on workstations and mobile devices. Personnel keep personally owned media off Organization systems. When someone finds a device with no identifiable owner, that person hands it to the ISSO without connecting it. No one plugs it in to see what it holds.

When the need ends, the owner returns the device, and the return is logged so that the issuance register stays accurate. Personnel report any connection of personal or ownerless media to a system, and the ISSO handles it as a security incident. Repeat findings feed the awareness content.

Evidence: the issuance register with owners, the request and return tickets, and the incident records for violations.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for MP
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric DPP.01
• Evidence for IG FISMA metric DPP.02
• Evidence for IG FISMA metric DPP.23

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1236: Electronic Records Management, current text.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• CUI Registry.
• FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
• ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
• NARA General Records Schedule 3.1: General Technology Management Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.