id: "MP-02" title: "Media Access" family: "MP" family_name: "Media Protection" sort_id: "mp-02" priority: "P2" implementation_level: "organization" enhancements: - mp-2.1 - mp-2.2
Statement
Restrict access to {{ insert: param, mp-2_prm_1 }} to {{ insert: param, mp-2_prm_2 }}.
Guidance
System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.
Assessment Objective: access to {{ insert: param, mp-02_odp.01 }} is restricted to {{ insert: param, mp-02_odp.02 }};
Assessment Objective: access to {{ insert: param, mp-02_odp.03 }} is restricted to {{ insert: param, mp-02_odp.04 }}.
System media protection policy
procedures addressing media access restrictions
access control policy and procedures
physical and environmental protection policy and procedures
media storage facilities
access control records
system security plan
other relevant documents or records
Organizational personnel with system media protection responsibilities
organizational personnel with information security responsibilities
system/network administrators
Organizational processes for restricting information media
mechanisms supporting and/or implementing media access restrictions