Navigate

MP-3

MP-3: Media Marking

The organization:

MP-3a.: Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

MP-3b.: Exempts [Assignment: organization-defined types of information system media] from marking as long as the media remain within [Assignment: organization-defined controlled areas].

Supplemental

The term security marking refers to the application/use of human-readable security attributes. The term security labeling refers to the application/use of security attributes with regard to internal data structures within information systems (see AC-16). Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Security marking is generally not required for media containing information determined by organizations to be in the public domain or to be publicly releasable. However, some organizations may require markings for public information indicating that the information is publicly releasable. Marking of information system media reflects applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

CIA Levels
Confidentiality	moderate
Integrity	unknown
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to MP-3.

Control	Description
AC-16	The organization: AC-16a.: Provides the means to associate [Assignment: organization-defined types of security attributes] having [Assignment: organization-defined security attribute values] with information in storage, in process, and/or in transmission; AC-16b.: Ensures that the security attribute associations are made and retained with the information; AC-16c.: Establishes the permitted [Assignment: organization-defined security attributes] for [Assignment: organization-defined information systems]; and AC-16d.: Determines the permitted [Assignment: organization-defined values or ranges] for each of the established security attributes.
PL-2	The organization: PL-2a.: Develops a security plan for the information system that: PL-2a.1.: Is consistent with the organization�s enterprise architecture; PL-2a.2.: Explicitly defines the authorization boundary for the system; PL-2a.3.: Describes the operational context of the information system in terms of missions and business processes; PL-2a.4.: Provides the security categorization of the information system including supporting rationale; PL-2a.5.: Describes the operational environment for the information system and relationships with or connections to other information systems; PL-2a.6.: Provides an overview of the security requirements for the system; PL-2a.7.: Identifies any relevant overlays, if applicable; PL-2a.8.: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and PL-2a.9.: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; PL-2b.: Distributes copies of the security plan and communicates subsequent changes to the plan to [Assignment: organization-defined personnel or roles]; PL-2c.: Reviews the security plan for the information system [Assignment: organization-defined frequency]; PL-2d.: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and PL-2e.: Protects the security plan from unauthorized disclosure and modification.
RA-3	The organization: RA-3a.: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits; RA-3b.: Documents risk assessment results in [Selection: security plan; risk assessment report; [Assignment: organization-defined document]]; RA-3c.: Reviews risk assessment results [Assignment: organization-defined frequency]; RA-3d.: Disseminates risk assessment results to [Assignment: organization-defined personnel or roles]; and RA-3e.: Updates the risk assessment [Assignment: organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

Enhancements

The controls below (if any) add on to the requirements of MP-3.

Control	Description
No controls

Related CCIs

The CCIs below are tied to MP-3.

CCI	Definition
CCI-001010	The organization marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.
CCI-001011	The organization exempts organization-defined types of information system media from marking as long as the media remain within organization-defined controlled areas.
CCI-001012	The organization defines types of information system media to exempt from marking as long as the media remain within organization-defined controlled areas.
CCI-001013	The organization defines controlled areas where organization-defined types of information system media are exempt from being marked.