Navigate

MP-4

MP-4: Media Storage

The organization:

MP-4a.: Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and

MP-4b.: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Supplemental

Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Physically controlling information system media includes, for example, conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for all stored media. Secure storage includes, for example, a locked drawer, desk, or cabinet, or a controlled media library. The type of media storage is commensurate with the security category and/or classification of the information residing on the media. Controlled areas are areas for which organizations provide sufficient physical and procedural safeguards to meet the requirements established for protecting information and/or information systems. For media containing information determined by organizations to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on organizations or individuals if accessed by other than authorized personnel, fewer safeguards may be needed. In these situations, physical access controls provide adequate protection.

CIA Levels
Confidentiality	moderate
Integrity	moderate
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to MP-4.

Control	Description
CP-6	The organization: CP-6a.: Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and CP-6b.: Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
CP-9	The organization: CP-9a.: Conducts backups of user-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9b.: Conducts backups of system-level information contained in the information system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; CP-9c.: Conducts backups of information system documentation including security-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; and CP-9d.: Protects the confidentiality, integrity, and availability of backup information at storage locations.
MP-2	The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
MP-7	The organization [Selection: restricts; prohibits] the use of [Assignment: organization-defined types of information system media] on [Assignment: organization-defined information systems or system components] using [Assignment: organization-defined security safeguards].
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Enhancements

The controls below (if any) add on to the requirements of MP-4.

Control	Description
MP-4 (1)	[Withdrawn: Incorporated into SC-28 (1)].
MP-4 (2)	The organization employs automated mechanisms to restrict access to media storage areas and to audit access attempts and access granted.

Related CCIs

The CCIs below are tied to MP-4.

CCI	Definition
CCI-001014	The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas.
CCI-001015	The organization defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas.
CCI-001016	The organization defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored.
CCI-001018	The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.