Media Protection Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the MP control family policy (POL-MP). It covers every control in the media protection family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the MP family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.DS — Data Security (Protect function)

3. Controls Covered #

This procedure covers the following 4 controls in the MP family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the MP control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

32 CFR Part 2002: Controlled Unclassified Information

• The organization must designate a CUI Senior Agency Official and Program Manager, mark and safeguard controlled unclassified information per the CUI Registry, apply the CUI requirements to information systems and to contractor agreements, and submit CUI program reports to the CUI Executive Agent (ISOO). (32 CFR Part 2002; ISOO Notice 2026-07)

NARA GRS 3.1: General Records Schedule 3.1: General Technology Management Records

• The organization must keep media sanitization records under NARA General Records Schedule 3.1, item 020, and destroy them only when that schedule allows. (NARA GRS 3.1, item 020)

NIST SP 800-88 Rev 2: Guidelines for Media Sanitization

• The organization should sanitize media using clear, purge, or destroy methods appropriate to the media type and the confidentiality of the information, verify the result, and keep a sanitization record — including at contract closeout for contractor-held media. (NIST SP 800-88 Rev 2)
• The organization should run a media sanitization program that selects sanitization and disposal techniques and controls based on the sensitivity of the information on the media. (NIST SP 800-88 Rev 2, Abstract and §2)

36 CFR Part 1236: Electronic Records Management

• The organization should when records must be kept longer than the system that holds them will last, plan their move to a new system or medium before that system is retired. (36 CFR 1236.14)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the MP controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Media Protection family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Information System Security Officer (ISSO) / Media Protection Officer carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the MP policy (POL-MP) for the role definitions.

4.2 Control-Specific Procedures #

MP-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] media protection policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the media protection policy and procedures; and
3. Review and update the current media protection:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The designated officials, meaning the Authorizing Official, System Owners, ISSOs, and key stakeholders, manage the review cycle for POL-MP and PROC-MP. They open a revision every 3 years, and sooner when a major change to applicable policy requires it. They collect input from the people who create, store, move, and destroy media every day, because that is where media protection fails.

The designated officials send the draft to stakeholders for comment. They decide each comment and record the approval before they publish the documents to the policy library. They send a distribution notice to every named role. The review record in the document management system holds the dates for the whole cycle.

Evidence: the version histories of both documents, the decided comments, the approval records, the distribution notices, and the review record.

MP-02 — Media Access #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

Restrict access to [Assignment: organization-defined types of digital and/or non-digital media — to be defined] to [Assignment: organization-defined personnel or roles — to be defined].

Procedure:

The System Owner or the Information Owner authorizes each individual by name on the access control list for the media. Only listed individuals retrieve, view, or handle the media. Requesters submit access requests in the ticketing system, and the owner decides them there, so the authorization trail is a record in the system and not a person’s memory. When a person’s duties change or the person leaves, the owner removes the entry and records the removal the same way.

Owners reconcile their lists against the people who have handled the media. The owner refers any unexplained handling to the ISSO as a potential incident. Non-digital media follows the same rules: the list controls access to the file room as firmly as it controls access to the media safe.

Evidence: the access control lists with their authorization entries, the request and removal tickets, the reconciliation records, and any ISSO referrals.

MP-06 — Media Sanitization #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.DS (Data Security)

1. Sanitize techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures — to be defined]; and
2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Procedure:

Media that reaches the end of its use enters the sanitization queue under its custody record. If the media holds federal records, the System Owner first confirms with the records officer that the records schedule allows disposal. The handler selects the NIST SP 800-88 Rev. 2 technique that fits the media type and the security category of the information: clear, purge, or destroy. The handler performs the technique or arranges it, and destroys media that cannot be sanitized reliably. A validator who did not do the work then checks the result. The handler records each action in the ticketing system: the media identifier, the technique, the date, the person performing, the person validating, and the final disposition. The System Owner keeps the record for 3 years under National Archives and Records Administration (NARA) General Records Schedule (GRS) 3.1, item 020.

Before a contract for sanitization or destruction starts, the ISSO documents due diligence on the vendor, such as an independent audit or a third-party certification. The ISSO sends it to the Contracting Officer, who keeps it in the contract file. The handler keeps the vendor’s destruction certificates with the records they support. The ISSO samples completed sanitizations to confirm the technique selection and the record quality.

Evidence: the sanitization and destruction records with validator and final disposition, the records schedule confirmations, vendor due diligence files, vendor certificates, and the ISSO’s sampling results.

MP-07 — Media Use #

Baselines: Low / Moderate / High CSF 2.0: PR.DS (Data Security)

1. [Selection: restrict; prohibit — to be defined] the use of [Assignment: organization-defined types of system media — to be defined] on [Assignment: organization-defined systems or system components — to be defined] using [Assignment: organization-defined controls — to be defined]; and
2. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Procedure:

A person who needs an approved flash drive or external hard disk drive submits a ticketing system request, and the request records the device and its named owner. Personnel use only issued devices on workstations and mobile devices. Personnel keep personally owned media off Organization systems. When someone finds a device with no identifiable owner, that person hands it to the ISSO without connecting it. No one plugs it in to see what it holds.

When the need ends, the owner returns the device, and the return is logged so that the issuance register stays accurate. Personnel report any connection of personal or ownerless media to a system, and the ISSO handles it as a security incident. Repeat findings feed the awareness content.

Evidence: the issuance register with owners, the request and return tickets, and the incident records for violations.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for MP
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric DPP.01
• Evidence for IG FISMA metric DPP.02
• Evidence for IG FISMA metric DPP.23

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 36 CFR Part 1236: Electronic Records Management, current text.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• CUI Registry.
• ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
• NARA General Records Schedule 3.1: General Technology Management Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.