Doc:NIST SP 800-53Ar1 Appendix F/Enhanced/MP/Low

NIST SP 800-53Ar1 Assessment Procedure Catalog, with SP 800-53r3 Security Controls

MEDIA PROTECTION

MP-1 MEDIA PROTECTION POLICY AND PROCEDURES

---

FAMILY: MEDIA PROTECTION

CLASS: OPERATIONAL

Security Control Baseline:

MP-1

Media Protection Policy and Procedures

P1

LOW MP-1

MOD MP-1

HIGH MP-1

SECURITY CONTROL

ASSESSMENT PROCEDURE
MP-1	MEDIA PROTECTION POLICY AND PROCEDURES
MP-1.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization develops and formally documents media protection policy; (ii) the organization media protection policy addresses: purpose; scope; roles and responsibilities; management commitment; coordination among organizational entities; and compliance; (iii) the organization disseminates formal documented media protection policy to elements within the organization having associated media protection roles and responsibilities; (iv) the organization develops and formally documents media protection procedures; (v) the organization media protection procedures facilitate implementation of the media protection policy and associated media protection controls; and (vi) the organization disseminates formal documented media protection procedures to elements within the organization having associated media protection roles and responsibilities. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Media protection policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information system media protection responsibilities].
MP-1.2	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines the frequency of media protection policy reviews/updates; (ii) the organization reviews/updates media protection policy in accordance with organization-defined frequency; and (iii) the organization defines the frequency of media protection procedure reviews/updates; (iv) the organization reviews/updates media protection procedures in accordance with organization-defined frequency. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Media protection policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information system media protection responsibilities].

MP-2 MEDIA ACCESS

---

FAMILY: MEDIA PROTECTION

CLASS: OPERATIONAL

Security Control Baseline:

MP-2

Media Access

P1

LOW MP-2

MOD MP-2 (1)

HIGH MP-2 (1)

SECURITY CONTROL

ASSESSMENT PROCEDURE
MP-2	MEDIA ACCESS
MP-2.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization defines: digital and non-digital media requiring restricted access; individuals authorized to access the media; security measures taken to restrict access; and (ii) the organization restricts access to organization-defined information system media to organization-defined authorized individuals using organization-defined security measures. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Information system media protection policy; procedures addressing media access; access control policy and procedures; physical and environmental protection policy and procedures; media storage facilities; access control records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information system media protection responsibilities].

MP-6 MEDIA SANITIZATION

---

FAMILY: MEDIA PROTECTION

CLASS: OPERATIONAL

Security Control Baseline:

MP-6

Media Sanitization

P1

LOW MP-6

MOD MP-6

HIGH MP-6 (1) (2) (3)

SECURITY CONTROL

ASSESSMENT PROCEDURE
MP-6	MEDIA SANITIZATION
MP-6.1	ASSESSMENT OBJECTIVE: Determine if: (i) the organization sanitizes information system media both digital and non-digital prior to: disposal; release out of organizational control; or release for reuse; and (ii) the organization employs sanitization mechanisms with strength and integrity commensurate with the classification or sensitivity of the information. POTENTIAL ASSESSMENT METHODS AND OBJECTS: Examine: [SELECT FROM: Information system media protection policy; procedures addressing media sanitization and disposal; media sanitization records; audit records; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information system media sanitization responsibilities].

Source

• NIST SP 800-53A Rev. 1 Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans (PDF)