---

id: "MP-04" title: "Media Storage" family: "MP" family_name: "Media Protection" sort_id: "mp-04" priority: "P2" implementation_level: "organization" enhancements: - mp-4.1 - mp-4.2

---

Physically control and securely store {{ insert: param, mp-4_prm_1 }} within {{ insert: param, mp-4_prm_2 }} ; and

Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Guidance

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection.

Assessment Objective: {{ insert: param, mp-04_odp.01 }} are physically controlled;

Assessment Objective: {{ insert: param, mp-04_odp.02 }} are physically controlled;

Assessment Objective: {{ insert: param, mp-04_odp.03 }} are securely stored within {{ insert: param, mp-04_odp.05 }};

Assessment Objective: {{ insert: param, mp-04_odp.04 }} are securely stored within {{ insert: param, mp-04_odp.06 }};

Assessment Objective: system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

System media protection policy

procedures addressing media storage

physical and environmental protection policy and procedures

access control policy and procedures

system media

designated controlled areas

system security plan

other relevant documents or records

Organizational personnel with system media protection and storage responsibilities

organizational personnel with information security responsibilities

Organizational processes for storing information media

mechanisms supporting and/or implementing secure media storage/media protection