Media Protection Policy

Media Protection Policy template: Ready-to-adopt Media Protection policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Media Protection policy states what the organization requires for media protection and who is accountable for it. It meets MP-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. MP-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
MP-1	Policy and Procedures	Yes	Yes	Yes	Yes
MP-2	Media Access	Yes	Yes	Yes
MP-3	Media Marking		Yes	Yes
MP-4	Media Storage		Yes	Yes
MP-5	Media Transport		Yes	Yes
MP-6	Media Sanitization	Yes	Yes	Yes	Yes
MP-6(1)	Review, Approve, Track, Document, and Verify			Yes
MP-6(2)	Equipment Testing			Yes
MP-6(3)	Nondestructive Techniques			Yes
MP-7	Media Use	Yes	Yes	Yes

Decisions to make first

The policy has 36 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Which kinds of portable storage may be used on the organization’s systems, and how is that enforced?	MP-2, MP-7	Only encrypted, organization-issued devices, each assigned to a named owner, enforced by endpoint device control; personally owned and unidentified devices blocked; exceptions approved by the system owner and recorded.	Chief Information Security Officer
Which marking scheme labels media, and who sets it?	MP-3	The organization’s information handling labels (for example Public, Internal and Confidential), defined in an information classification or handling standard that the Chief Information Security Officer owns, with legally required markings added where they apply.	Chief Information Security Officer
Where are media stored, and how do they travel between sites?	MP-4, MP-5	A media library or locked cabinets in the data center, with an inventory reconciled each quarter; media leaving a controlled area are encrypted, packed in sealed, tamper-evident containers and carried by authorized staff or a tracked courier, with a chain-of-custody record.	System owner
Who sanitizes media, and is an outside sanitization or destruction provider used?	MP-6, MP-6(1), MP-6(2)	The IT operations team clears or purges media to be reused and keeps failed and retired media in a locked container; a contracted destruction provider destroys the rest and issues a certificate listing each device’s serial number; every action is recorded in the media sanitization record.	Chief Information Security Officer
How is information in cloud and other virtual storage sanitized when it is no longer needed?	MP-6	Cryptographic erase, by destroying the customer-managed keys under the encryption and key management standard, with the provider’s authorization or attestation covering sanitization of its physical media; recorded in the external service review.	System owner

Record your values in the Media Protection decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: MP pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet MP-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the MP-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Media Protection, and who is accountable for meeting those requirements. (MP-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (MP-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (MP-1a.1(a))
• The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (MP-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (MP-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (MP-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (MP-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (MP-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (MP-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (MP-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (MP-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (MP-1a.1(a))

Procedures

The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (MP-1a.2)

Dissemination

• The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the media protection policy is to be disseminated Typical: everyone within its scope, through the policy library. (MP-1a)
• The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the media protection procedures are to be disseminated Typical: the people who carry them out, and the system owners. (MP-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Media access (MP-2)

Guidance

MP-2 restricts who may access media; MP-7 restricts which media may be used on systems, a distinction NIST’s MP-7 discussion draws. NIST’s MP-2 discussion covers digital media (flash drives, tapes, external drives, optical discs) and non-digital media (paper and microfilm). The usual way to restrict access is to keep media where only authorized people can reach them (MP-4) and to encrypt digital media so that only holders of the key can read them, as the encryption and key management standard requires for removable media (SC-28(1)). Assessors ask who can get into the media library or cabinets, and compare that list with the people authorized for the information.

• The System owner shall restrict access to Fill in: types of digital media to which access is restricted Typical: removable and portable storage media (flash drives, external drives, memory cards and optical discs), backup media, and storage removed from service to Fill in: personnel or roles authorized to access digital media Typical: personnel whose access authorizations for the system permit access to the information on the media. (MP-2)
• The System owner shall restrict access to Fill in: types of non-digital media to which access is restricted Typical: paper and microfilm containing information not approved for public release, including printed system output to Fill in: personnel or roles authorized to access non-digital media Typical: personnel whose access authorizations permit access to the information on the media. (MP-2)
• The System owner shall enforce these restrictions by storing the media in controlled areas (MP-4) and, for digital media, by encryption whose keys only authorized personnel can use (SC-28(1)). (MP-2)
• The System owner shall review the list of people with access to each media library or storage area at least annually, and remove those who no longer need it. (MP-2)

Media marking (MP-3)

Guidance

MP-3 is in the Moderate and High baselines. Marking means a human-readable label on the media or its container that shows how the information must be handled, as NIST’s MP-3 discussion describes. NIST’s discussion also says markings are generally not required for media holding only information approved for public release. The exemption in MP-3b suits media that never leave a controlled area and are handled by automated equipment, such as tapes in a tape library; once such media leave, they are marked.

• The System owner shall mark system media to indicate the distribution limitations, handling caveats and applicable security markings, if any, of the information they contain. (MP-3a)
• Markings shall use the handling labels defined in Fill in: the organization’s information classification or handling standard, together with any marking that a law, regulation or contract requires for the information. (MP-3a)
• Digital media shall carry the marking on the media themselves where they are large enough, and otherwise on their container. (MP-3a)
• The System owner shall exempt Fill in: types of system media exempt from marking when remaining in controlled areas Typical: backup media and drives held in automated tape libraries, storage arrays and server enclosures from marking only while the media remain within Fill in: controlled areas where media is exempt from marking Typical: the data center and the media library, where physical access is limited to authorized personnel (PE-3), and shall mark them before they leave. (MP-3b)

Federal systems

Under 32 CFR 2002.20(a)(1), agencies and authorized holders must uniformly and conspicuously apply CUI markings to all controlled unclassified information (CUI), in accordance with 32 CFR Part 2002 and the CUI Registry, unless that part or the CUI Executive Agent specifically permits otherwise. Under 2002.20(a)(7), a missing marking does not exempt an authorized holder from the handling requirements. Under 2002.20(a)(8), when marking CUI individually is impractical because of its quantity or nature, or under a limited marking waiver, authorized holders must make recipients aware of its CUI status by an alternate method that is readily apparent, such as signs in storage areas or on containers. As of October 2026.

• The System owner shall mark system media containing CUI with CUI markings in accordance with 32 CFR 2002.20 and the CUI Registry. (MP-3a)
• The System owner shall not apply the MP-3b exemption to media containing CUI unless their CUI status is shown by an alternate marking method that 32 CFR 2002.20(a)(8) permits, such as signs in the storage area or on the container. (MP-3b)

Media storage (MP-4)

Guidance

MP-4 is in the Moderate and High baselines. NIST’s MP-4 discussion describes physical control as inventories, check-out and return procedures, and accountability for stored media, and secure storage as a locked drawer, desk or cabinet or a controlled media library, matched to the security category of the information. MP-4b covers media until they are sanitized or destroyed, so failed drives and retired equipment waiting for sanitization stay in a controlled area and on the inventory. The media sanitization record closes each item out.

• The System owner shall physically control Fill in: types of digital media to be physically controlled Typical: removable and portable storage media, backup media, and storage removed from service and awaiting sanitization and Fill in: types of non-digital media to be physically controlled Typical: paper and microfilm containing information not approved for public release. (MP-4a)
• The System owner shall securely store Fill in: types of digital media to be securely stored Typical: removable and portable storage media, backup media, and storage removed from service and awaiting sanitization within Fill in: controlled areas within which to securely store digital media Typical: the data center, the media library, or a locked container in an area with physical access control, with access limited to authorized personnel. (MP-4a)
• The System owner shall securely store Fill in: types of non-digital media to be securely stored Typical: paper and microfilm containing information not approved for public release within Fill in: controlled areas within which to securely store non-digital media Typical: locked cabinets, drawers or rooms with access limited to authorized personnel. (MP-4a)
• The System owner shall keep an inventory of the digital media in each media library or store, with check-out and return records, and reconcile it at least quarterly. (MP-4a)
• Digital media stored outside the data center shall be encrypted as the encryption and key management standard requires for removable media (SC-28(1)). (MP-4a)
• The System owner shall protect these media until they are destroyed or sanitized using approved equipment, techniques and procedures, keeping media that are awaiting sanitization in the same controlled areas and on the inventory until the sanitization is recorded. (MP-4b)

Federal systems

Under 32 CFR 2002.14(c), authorized holders of controlled unclassified information (CUI) must take reasonable precautions against its unauthorized disclosure, including establishing and using controlled environments in which to protect it from unauthorized access or disclosure, and, when it is outside a controlled environment, keeping it under the authorized holder’s direct control or protecting it with at least one physical barrier. As of October 2026.

• The System owner shall store media containing CUI only in controlled environments that meet 32 CFR 2002.14(c), and shall keep such media under an authorized holder’s direct control, or behind at least one physical barrier such as a locked container, whenever they are outside a controlled environment. (MP-4a)

Media transport (MP-5)

Guidance

MP-5 is in the Moderate and High baselines. NIST’s MP-5 discussion names cryptography and locked containers as transport protections, and describes accountability as restricting transport to authorized personnel and tracking or obtaining records of the media as they move, to prevent and detect loss, destruction or tampering. Couriers may be external to the organization. Common cases are backup media going to the alternate storage site (CP-6, CP-9), drives going to a destruction provider, and media sent to another organization under an information exchange agreement. Keep the transport records with the system’s records; for drives sent for destruction, record the transport in the media sanitization record.

• The System owner shall protect and control Fill in: types of system media to protect and control during transport outside of controlled areas Typical: all digital and non-digital media containing information not approved for public release during transport outside of controlled areas using Fill in: controls used to protect system media outside of controlled areas Typical: encryption of digital media under the encryption and key management standard, and sealed, tamper-evident packaging or locked containers and Fill in: controls used to control system media outside of controlled areas Typical: transport only by authorized personnel or by a courier service with tracking and a signature on delivery, and a chain-of-custody record from release to receipt. (MP-5a)
• Digital media shall be encrypted before they leave a controlled area, as the encryption and key management standard requires for removable media, and the key or password shall not travel with the media. (MP-5a)
• The System owner shall maintain accountability for system media during transport, so that each item can be traced from its release to its receipt. (MP-5b)
• The sender shall confirm receipt of each shipment, and shall report a shipment that does not arrive when expected, or arrives with its packaging opened or damaged, as a security incident under the incident response plan (IR-6). (MP-5b)
• The System owner shall document each transport of system media: the media and their identifiers, who released them, the carrier, the recipient, the tracking number where there is one, and the dates of release and receipt. (MP-5c)
• The System owner shall designate the personnel authorized to release, carry and receive system media, and shall use external couriers only under a contract or agreement that requires tracking and a signature on delivery. (MP-5d)

Federal systems

Under 32 CFR 2002.14(d), authorized holders sending controlled unclassified information (CUI) may use the United States Postal Service, any commercial delivery service, or interoffice or interagency mail; should use in-transit automated tracking and accountability tools; and must mark packages that contain CUI as 32 CFR Part 2002 and the CUI Executive Agent’s guidance require (see 32 CFR 2002.20). As of October 2026.

• When shipping media containing CUI, the System owner shall use the United States Postal Service, a commercial delivery service, or interoffice or interagency mail, with in-transit automated tracking, and shall mark the packages as 32 CFR 2002.14(d) and 2002.20 require. (MP-5a)

Media sanitization (MP-6)

Guidance

NIST’s MP-6 discussion applies sanitization to all digital and non-digital media subject to disposal or reuse, removable or not, and names the storage in scanners, copiers, printers, notebook computers, workstations, network components and mobile devices. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025, final; as of October 2026), defines three methods: clear (logical techniques against simple, non-invasive recovery), purge (recovery infeasible with state-of-the-art laboratory techniques, media possibly reusable) and destroy (recovery infeasible and the media unusable). It says purge should be used instead of clear when possible, and that the decision rests on the confidentiality of the information rather than the type of media; it points to the IEEE 2883 series for technique by media type. For cloud and other virtual storage, it notes that cryptographic erase may be the only purge option. It also advises against shredding or pulverizing storage devices for anything but the lowest security categories, since denser, harder media can survive them; paper can be shredded.

The media sanitization procedure named below is the organization’s: a table of the media types in use with the method, technique, tool and verification for each, which the media sanitization record provides. SP 800-88 Rev. 2 section 4.6 recommends a certificate of sanitization for each item, and the record’s register holds those details. Keep the values consistent with the Maintenance policy: equipment leaving for repair is sanitized first (MA-2d), and media that cannot be sanitized, such as a failed drive, stay with the organization.

• The System owner shall sanitize Fill in: system media to be sanitized prior to disposal Typical: all digital and non-digital system media, including the storage in workstations, laptops, servers, network devices, mobile devices, printers, copiers and scanners prior to disposal using Fill in: sanitization techniques and procedures to be used for sanitization prior to disposal Typical: purge or destroy for digital media, and destruction by shredding or incineration for paper and other hard copy, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2. (MP-6a)
• The System owner shall sanitize Fill in: system media to be sanitized prior to release from organizational control Typical: all digital and non-digital system media, including media returned to a lessor or vendor, exchanged under warranty, or sent off site for repair prior to release out of organizational control using Fill in: sanitization techniques and procedures to be used for sanitization prior to release from organizational control Typical: purge, including cryptographic erase where its conditions are met, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2; media that cannot be purged and verified are destroyed, not released. (MP-6a)
• The System owner shall sanitize Fill in: system media to be sanitized prior to release for reuse Typical: all digital system media reissued to another user, system or part of the organization prior to release for reuse using Fill in: sanitization techniques and procedures to be used for sanitization prior to release for reuse Typical: clear for reuse within the same system or by users with the same access authorizations, and purge for other reuse, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2. (MP-6a)
• The Chief Information Security Officer shall maintain a media sanitization procedure that follows NIST SP 800-88 Rev. 2 and names, for each media type in use, the sanitization method (clear, purge or destroy), the technique and tool, and how the result is verified. (MP-6a)
• Before media are sanitized, the System owner shall confirm that the information on them is not subject to a records retention requirement or legal hold that has not yet been met (SI-12). (MP-6a)
• Storage media that cannot be sanitized by the method the procedure requires, including failed drives, shall be kept within the organization and destroyed, and shall not be released out of organizational control. (MP-6a)
• Each sanitization shall be verified and recorded in the media sanitization record, including the media’s identifiers, the method and technique, who performed and verified it, and the date. (MP-6a)
• Where an external provider sanitizes or destroys media, its contract shall specify the method, require a certificate listing each item by serial number, and allow the organization to witness or verify the work. (MP-6a)
• The System owner shall employ sanitization mechanisms whose strength and integrity are commensurate with the security category of the information, choosing the method by the confidentiality of the information as NIST SP 800-88 Rev. 2 describes. (MP-6b)
• Clear shall be used only for media that remain under organizational control, and then only for reuse within the same system or by users with the same access authorizations, for low-impact information, or for moderate-impact information where the System owner has accepted the residual risk in writing. (MP-6b)
• Storage devices holding moderate- or high-impact information shall be destroyed by disintegration, incineration or melting, or purged first, rather than only shredded or pulverized. (MP-6b)
• Cryptographic erase shall be used only where the media’s encryption and key management meet the conditions in NIST SP 800-88 Rev. 2 section 3.2, and the keys are managed under the encryption and key management standard (SC-12). (MP-6b)

Federal systems

Under 32 CFR 2002.14(f), authorized holders may destroy controlled unclassified information (CUI) when the agency no longer needs it and records disposition schedules published or approved by NARA allow. Agencies destroying CUI, including in electronic form, must make it unreadable, indecipherable and irrecoverable, using any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise, the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. Under 2002.14(e)(2), when CUI is reproduced on printers, copiers, scanners or fax machines, the equipment must not retain data, or the agency must sanitize it in accordance with NIST SP 800-53. NIST SP 800-88 Rev. 2, section 3.2, states that federal agencies must use encryption modules validated to the current FIPS 140 standard to have assurance in cryptographic erase on self-encrypting drives. As of October 2026.

• The System owner shall destroy CUI only when the agency no longer needs it and NARA-approved records disposition schedules allow, and only by a method that 32 CFR 2002.14(f)(2) permits. (MP-6a)
• The System owner shall ensure printers, copiers, scanners and fax machines used to reproduce CUI do not retain data, or are sanitized in accordance with NIST SP 800-53, as 32 CFR 2002.14(e)(2) requires. (MP-6a)
• Cryptographic erase shall rely only on encryption modules validated to the current FIPS 140 standard. (MP-6b)

Media use (MP-7)

Guidance

NIST’s MP-7 discussion contrasts it with MP-2: MP-2 restricts who may access media, while MP-7 restricts which media may be used on systems. It lists the usual technical controls: disabling ports or the ability to read or write to devices, limiting use to approved, organization-provided devices that are not personally owned, and blocking writes to portable devices. Requiring an identifiable owner, MP-7b, lets the organization assign responsibility for a device’s known vulnerabilities. The typical values match the Access Control Policy, which allows only encrypted, organization-issued devices on external systems (AC-20(2)), and the encryption and key management standard, which requires encryption of removable media (SC-28(1)). Choose “prohibit” for systems whose risk does not justify any portable storage.

• The System owner shall Select one: restrict; prohibit Typical: restrict the use of Fill in: types of system media to be restricted or prohibited from use on systems or system components Typical: writable portable storage devices, such as USB flash drives, external hard drives and memory cards, and writable optical media on Fill in: systems or system components on which the use of specific types of system media to be restricted or prohibited Typical: all organizational workstations, laptops and servers using Fill in: controls to restrict or prohibit the use of specific types of system media on systems or system components Typical: endpoint device control that blocks portable storage devices other than encrypted, organization-issued devices assigned to a named owner, with exceptions approved by the system owner and recorded. (MP-7a)
• Personally owned portable storage devices shall not be connected to organizational systems. (MP-7a)
• The System owner shall prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner. (MP-7b)
• Each organization-issued portable storage device shall be recorded with its owner in the component inventory (CM-8), and personnel shall turn in any device they find whose owner is unknown, without connecting it, to the Security operations team. (MP-7b)

Review and update

• The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency with which the current media protection policy is reviewed and updated Typical: annually and following Fill in: events that would require the current media protection policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (MP-1c.1)
• The Fill in: an official to manage the media protection policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency with which the current media protection procedures are reviewed and updated Typical: annually and following Fill in: events that would require media protection procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (MP-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (MP-1a.1(b))