Navigate

MP-2

MP-2: Media Access

Restrict access to [one of ] to [one of ].

Supplemental

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
CMMC, Classified, DAF Baseline, Int-A, Int-B, Int-C, Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate)

CSF Categories
PR.DS-1, PR.PT-2

Related Controls

The controls below (if any) were marked by NIST as being related to MP-2.

Control	Description
AC-19	a: Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b: Authorize the connection of mobile devices to organizational systems.
AU-9	a: Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b: Alert [personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information is/are defined;] upon detection of unauthorized access, modification, or deletion of audit information.
CP-2	a: Develop a contingency plan for the system that: 1: Identifies essential mission and business functions and associated contingency requirements; 2: Provides recovery objectives, restoration priorities, and metrics; 3: Addresses contingency roles, responsibilities, assigned individuals with contact information; 4: Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5: Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6: Addresses the sharing of contingency information; and 7: Is reviewed and approved by [one of ]; b: Distribute copies of the contingency plan to [one of ]; c: Coordinate contingency planning activities with incident handling activities; d: Review the contingency plan for the system [frequency of contingency plan review is defined;]; e: Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f: Communicate contingency plan changes to [one of ]; g: Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h: Protect the contingency plan from unauthorized disclosure and modification.
CP-9	a: Conduct backups of user-level information contained in [system components for which to conduct backups of user-level information is defined;] [frequency at which to conduct backups of user-level information consistent with recovery time and recovery point objectives is defined;]; b: Conduct backups of system-level information contained in the system [frequency at which to conduct backups of system-level information consistent with recovery time and recovery point objectives is defined;]; c: Conduct backups of system documentation, including security- and privacy-related documentation [frequency at which to conduct backups of system documentation consistent with recovery time and recovery point objectives is defined;] ; and d: Protect the confidentiality, integrity, and availability of backup information.
CP-10	Provide for the recovery and reconstitution of the system to a known state within [one of ] after a disruption, compromise, or failure.
MA-5	a: Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel; b: Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and c: Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
MP-4	a: Physically control and securely store [one of ] within [one of ] ; and b: Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-6	a: Sanitize [one of ] prior to disposal, release out of organizational control, or release for reuse using [one of ] ; and b: Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
PE-2	a: Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b: Issue authorization credentials for facility access; c: Review the access list detailing authorized facility access by individuals [frequency at which to review the access list detailing authorized facility access by individuals is defined;] ; and d: Remove individuals from the facility access list when access is no longer required.
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
SC-12	Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [requirements for key generation, distribution, storage, access, and destruction are defined;].
SC-13	a: Determine the [cryptographic uses are defined;] ; and b: Implement the following types of cryptography required for each specified cryptographic use: [types of cryptography for each specified cryptographic use are defined;].
SC-34	For [system components for which the operating environment and applications are to be loaded and executed from hardware-enforced, read-only media are defined;] , load and execute: a: The operating environment from hardware-enforced, read-only media; and b: The following applications from hardware-enforced, read-only media: [applications to be loaded and executed from hardware-enforced, read-only media are defined;].
SI-12	Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Enhancements

The controls below (if any) add on to the requirements of MP-2.

Control	Description
MP-2(1)
MP-2(2)

Related CCIs

The CCIs below are tied to MP-2.

CCI	Definition
CCI-001003	Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.
CCI-001004	Defines types of digital and/or non-digital media for which the organization restricts access.
CCI-001005	Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.