# Media Protection Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/mp/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet MP-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the MP-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Media Protection, and who is accountable for meeting those requirements. (MP-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MP-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (MP-1a.1(a))
- The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (MP-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (MP-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (MP-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (MP-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MP-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (MP-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (MP-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (MP-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (MP-1a.1(a))

## Procedures

The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (MP-1a.2)

## Dissemination

- The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the media protection policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (MP-1a)
- The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the media protection procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (MP-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Media sanitization (MP-6)

> **Guidance:** NIST's MP-6 discussion applies sanitization to all digital and non-digital media subject to disposal or reuse, removable or not, and names the storage in scanners, copiers, printers, notebook computers, workstations, network components and mobile devices. [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final), Guidelines for Media Sanitization (September 2025, final; as of October 2026), defines three methods: clear (logical techniques against simple, non-invasive recovery), purge (recovery infeasible with state-of-the-art laboratory techniques, media possibly reusable) and destroy (recovery infeasible and the media unusable). It says purge should be used instead of clear when possible, and that the decision rests on the confidentiality of the information rather than the type of media; it points to the IEEE 2883 series for technique by media type. For cloud and other virtual storage, it notes that cryptographic erase may be the only purge option. It also advises against shredding or pulverizing storage devices for anything but the lowest security categories, since denser, harder media can survive them; paper can be shredded.
>
> The media sanitization procedure named below is the organization's: a table of the media types in use with the method, technique, tool and verification for each, which the [media sanitization record](https://kston83.github.io/nist-guide/templates/forms/media-sanitization-record/) provides. SP 800-88 Rev. 2 section 4.6 recommends a certificate of sanitization for each item, and the record's register holds those details. Keep the values consistent with the [Maintenance policy](https://kston83.github.io/nist-guide/templates/policies/ma/): equipment leaving for repair is sanitized first (MA-2d), and media that cannot be sanitized, such as a failed drive, stay with the organization.

- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to disposal. Typical: all digital and non-digital system media, including the storage in workstations, laptops, servers, network devices, mobile devices, printers, copiers and scanners] prior to disposal using [Fill in: sanitization techniques and procedures to be used for sanitization prior to disposal. Typical: purge or destroy for digital media, and destruction by shredding or incineration for paper and other hard copy, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2]. (MP-6a)
- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to release from organizational control. Typical: all digital and non-digital system media, including media returned to a lessor or vendor, exchanged under warranty, or sent off site for repair] prior to release out of organizational control using [Fill in: sanitization techniques and procedures to be used for sanitization prior to release from organizational control. Typical: purge, including cryptographic erase where its conditions are met, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2; media that cannot be purged and verified are destroyed, not released]. (MP-6a)
- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to release for reuse. Typical: all digital system media reissued to another user, system or part of the organization] prior to release for reuse using [Fill in: sanitization techniques and procedures to be used for sanitization prior to release for reuse. Typical: clear for reuse within the same system or by users with the same access authorizations, and purge for other reuse, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2]. (MP-6a)
- The [Chief Information Security Officer] shall maintain a media sanitization procedure that follows NIST SP 800-88 Rev. 2 and names, for each media type in use, the sanitization method (clear, purge or destroy), the technique and tool, and how the result is verified. (MP-6a)
- Before media are sanitized, the [System owner] shall confirm that the information on them is not subject to a records retention requirement or legal hold that has not yet been met (SI-12). (MP-6a)
- Storage media that cannot be sanitized by the method the procedure requires, including failed drives, shall be kept within the organization and destroyed, and shall not be released out of organizational control. (MP-6a)
- Each sanitization shall be verified and recorded in the media sanitization record, including the media's identifiers, the method and technique, who performed and verified it, and the date. (MP-6a)
- Where an external provider sanitizes or destroys media, its contract shall specify the method, require a certificate listing each item by serial number, and allow the organization to witness or verify the work. (MP-6a)
- The [System owner] shall employ sanitization mechanisms whose strength and integrity are commensurate with the security category of the information, choosing the method by the confidentiality of the information as NIST SP 800-88 Rev. 2 describes. (MP-6b)
- Clear shall be used only for media that remain under organizational control, and then only for reuse within the same system or by users with the same access authorizations, for low-impact information, or for moderate-impact information where the [System owner] has accepted the residual risk in writing. (MP-6b)
- Storage devices holding moderate- or high-impact information shall be destroyed by disintegration, incineration or melting, or purged first, rather than only shredded or pulverized. (MP-6b)
- Cryptographic erase shall be used only where the media's encryption and key management meet the conditions in NIST SP 800-88 Rev. 2 section 3.2, and the keys are managed under the encryption and key management standard (SC-12). (MP-6b)

#### Federal systems

Under [32 CFR 2002.14(f)](https://www.ecfr.gov/current/title-32/section-2002.14), authorized holders may destroy controlled unclassified information (CUI) when the agency no longer needs it and records disposition schedules published or approved by NARA allow. Agencies destroying CUI, including in electronic form, must make it unreadable, indecipherable and irrecoverable, using any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise, the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. Under 2002.14(e)(2), when CUI is reproduced on printers, copiers, scanners or fax machines, the equipment must not retain data, or the agency must sanitize it in accordance with NIST SP 800-53. [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final), section 3.2, states that federal agencies must use encryption modules validated to the current FIPS 140 standard to have assurance in cryptographic erase on self-encrypting drives. As of October 2026.

- The [System owner] shall destroy CUI only when the agency no longer needs it and NARA-approved records disposition schedules allow, and only by a method that 32 CFR 2002.14(f)(2) permits. (MP-6a)
- The [System owner] shall ensure printers, copiers, scanners and fax machines used to reproduce CUI do not retain data, or are sanitized in accordance with NIST SP 800-53, as 32 CFR 2002.14(e)(2) requires. (MP-6a)
- Cryptographic erase shall rely only on encryption modules validated to the current FIPS 140 standard. (MP-6b)

## Review and update

- The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency with which the current media protection policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current media protection policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (MP-1c.1)
- The [Fill in: an official to manage the media protection policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency with which the current media protection procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require media protection procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (MP-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MP-1a.1(b))