Cyber · Trackr The Free Compliance Library
⌘K
MP · Plan wizard

Media Protection Plan

Documents how the system's storage media — both digital and non-digital — are governed across access, marking, storage, transport, sanitization, and use. Covers the controls of the MP family in NIST SP 800-53 r5 and aligns with NIST SP 800-88 r1 (Sanitization Guidelines), CNSSI 1253 (Categorization and Control Selection for National Security Systems), 32 CFR Part 2002 (CUI Marking), and FIPS 199 / FIPS 200 categorization frameworks.

1 System metadata
Full official name of the information system.
Short identifier used in headings and references.
Role or named individual accountable for the system.
Describe what falls inside the authorization boundary - components, services, networks, data flows.
2 Baseline
Determines which controls in this family appear in your plan.
3 Media Protection approach
Approach basics → §4.x

Tooling and roles that anchor the rest of the plan.

Where storage media are inventoried (e.g., 'CMDB media-asset module', 'Dedicated media-tracker spreadsheet under version control', 'Inherited from cloud — no system-managed physical media').
Who performs media sanitization (e.g., 'Internal IT Operations using Blancco Drive Eraser', 'NSA-listed vendor for Purge / Destroy', 'GSA-schedule contract destruction vendor').
Where certificates of destruction are retained (records-management system, GRC tool, secure file share).
Brief phrase summarizing transport workflow (e.g., 'GSA-bonded courier with sealed tamper-evident container; chain-of-custody form per shipment', 'Encrypted transport via FedEx with signature-required tracking + post-transit verification').
Brief phrase summarizing the removable-media posture (e.g., 'USB ports disabled by GPO with allowlist for org-issued encrypted drives', 'Read-only USB enforcement via DLP', 'Physical port blockers on all hosts; allowlist enforcement at endpoint').
Media Inventory → §2.x

Categories of media in scope and how they are tracked.

How often the media inventory is reconciled with physical reality (e.g., 'Quarterly with annual full audit').
Media Access (MP-2) → §4.x

Who can access media and on what basis.

What entitles a person to access controlled media (need-to-know, role-based, screening level — reference PS-3).
When access events to controlled media are logged. Sign-in / sign-out for physical media; system audit for digital media access (overlaps with AU-2).
How often the authorized-access list is reviewed (typical: 'Annually + on personnel change'). MP-2 ODV.
Media Marking (MP-3) → §4.x

Classification labels and handling markings.

How each media type is marked. Example: 'Backup tapes: serialized adhesive label with classification + asset tag; portable drives: laser-engraved housing + register entry; hardcopy: top-and-bottom-of-each-page banner per 32 CFR Part 2002.'
Per MP-3 ODV, types of media exempted from marking requirements (e.g., 'Public-information media in a controlled facility'). Document rationale.
How often the marking is audited (e.g., 'Quarterly random sample of media items'). Captures markings degraded by wear or improperly applied at issue.
Media Storage (MP-4) → §4.x

Where and how media at rest is physically protected.

How stored media is cryptographically protected. SED + LUKS + BitLocker / FileVault for portable media. Reference SC-12 / SC-28 for keys + at-rest encryption.
Temperature, humidity, EMI / magnetic-field protection where applicable (especially for tape archives). Reference PE-14 for facility environmental.
If applicable: off-site provider name, contract, access-control posture, audit cadence. Reference SA-9.
Media Transport (MP-5) → §4.x

Movement of media outside controlled areas.

Couriers authorized to transport media outside controlled areas. Cleared employees, GSA-bonded carriers, vendor-cleared personnel. MP-5 ODV.
Media Sanitization (MP-6) → §4.x

Sanitization methods, certificates, and decision criteria.

How the sanitization category is chosen. Reference NIST SP 800-88 r1 Decision Tree (Reuse vs Recycle, Internal vs External, Sensitivity).
How sanitization is validated. Tooling logs (Blancco / Killdisk certificate), random-sample re-read tests, vendor-provided certificate of destruction with serial-number match.
How each media type is physically destroyed when destroy is required (e.g., 'HDDs: degauss + shred; SSDs: cryptographic erase + shred; tapes: shred; optical: shred').
How often the sanitization process / equipment is reviewed for effectiveness. MP-6 ODV.
Media Use (MP-7) → §4.x

Restrictions on removable and portable media use.

How media-use policy is enforced (DLP, GPO, MDM port restrictions, physical port blockers, BIOS password).
Workflow for granting exceptions to media-use policy (e.g., for vendor-supplied installation media). Time-limited exception with retroactive review.
Per MP-7 ODV, restriction on media without identifiable owner (anonymous origin). Common posture: prohibited for non-public information.
Media Scope and Coverage → §2.x

Quantitative scope numbers that anchor metrics later in the plan.

Approximate count of media items currently in the inventory. Anchors the inventory-reconciliation effort.
Approximate count of media items sanitized / destroyed per quarter.
Approximate count of MP-5 transport events per quarter.
Count of personnel on the authorized-media-access list.
Media-Protection Metrics & KPIs → §6.x

Metrics tracked to demonstrate MP control effectiveness.

    Suggested:
    Lost-Media Incident Response → §6.x

    How lost-media events are detected and handled.

    Workflow when media is reported lost. Immediate: spinning up IR investigation, assessing data exposure (encrypted vs cleartext), notification obligations (per legal counsel + privacy officer if PII).
    Cross-references to other RMF artifacts → §7

    Where this plan plugs into the broader RMF package.

    Where in the SSP the MP control implementations are summarized (e.g., 'SSP §13.8').
    Convention for MP-related POA&M items (e.g., 'POAM-MP-' for general).
    How MP-5 transport events route through the PE-16 delivery / removal workflow.
    How MP-6 sanitization is invoked before vendor maintenance per MA-2; how MA-3(2) media-inspection echoes MP scanning practice.
    How MP-4 / MP-5 cryptographic protection uses SC-12 keys and SC-28 at-rest encryption mechanisms.
    How MP-6 / MP-7 lifecycle aligns with SI-12 information management.
    How lost-media incidents trigger the IR plan workflow.
    Pointer to the CA-7 monitoring strategy document tying MP continuous-monitoring metrics to the broader ConMon plan.
    4 Per-control implementation

    Pick a baseline in section 2 and the applicable controls will appear here. Each control gets a card with the official text, related controls, linked CCIs, and fields for your implementation status, narrative, responsible role, and evidence.

    5 Document metadata

    Your answers autosave to this browser. Click Save progress to download a JSON file you can re-upload later or share.