CCI-001004

Implementation Guidance

Determine if: - access to [MP-02_ODP[01]; types of digital media to which access is restricted are defined] is restricted to [MP-02_ODP[02]; personnel or roles authorized to access digital media is/are defined]. - access to [MP-02_ODP[03]; types of non-digital media to which access is restricted are defined] is restricted to [MP-02_ODP[04]; personnel or roles authorized to access non-digital media is/are defined].

Validation Procedures

Examine: [SELECT FROM: System media protection policy; procedures addressing media access restrictions; access control policy and procedures; physical and environmental protection policy and procedures; media storage facilities; access control records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system media protection responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for restricting information media; mechanisms supporting and/or implementing media access restrictions].