Navigate

MP-2

MP-2: Media Access

The organization restricts access to [organization-defined types of digital and/or non-digital media] to [organization-defined personnel or roles].

Supplemental

Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Restricting non-digital media access includes, for example, denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers. Restricting access to digital media includes, for example, limiting access to design specifications stored on compact disks in the media library to the project leader and the individuals on the development team.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.PT-2

Related Controls

The controls below (if any) were marked by NIST as being related to MP-2.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
MP-4	The organization: a: Physically controls and securely stores [organization-defined types of digital and/or non-digital media] within [organization-defined controlled areas]; and b: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
PE-2	The organization: a: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; b: Issues authorization credentials for facility access; c: Reviews the access list detailing authorized facility access by individuals [organization-defined frequency]; and d: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PL-2	The organization: a: Develops a security plan for the information system that: 1: Is consistent with the organization’s enterprise architecture; 2: Explicitly defines the authorization boundary for the system; 3: Describes the operational context of the information system in terms of missions and business processes; 4: Provides the security categorization of the information system including supporting rationale; 5: Describes the operational environment for the information system and relationships with or connections to other information systems; 6: Provides an overview of the security requirements for the system; 7: Identifies any relevant overlays, if applicable; 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles]; c: Reviews the security plan for the information system [organization-defined frequency]; d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and e: Protects the security plan from unauthorized disclosure and modification.

Enhancements

The controls below (if any) add on to the requirements of MP-2.

Control	Description
MP-2(1)
MP-2(2)

Related CCIs

The CCIs below are tied to MP-2.

CCI	Definition
CCI-001003	Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.
CCI-001004	Defines types of digital and/or non-digital media for which the organization restricts access.
CCI-001005	Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media.