Media Protection Decision Worksheet

Media Protection Decision Worksheet template: Every decision the Media Protection family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Operate	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Media Protection family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every MP control in the baseline, with a typical value where the Media Protection Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

38 decisions.

Decision	Control	Typical value	Who decides
Which kinds of portable storage may be used on the organization’s systems, and how is that enforced?	MP-2, MP-7	Only encrypted, organization-issued devices, each assigned to a named owner, enforced by endpoint device control; personally owned and unidentified devices blocked; exceptions approved by the system owner and recorded.	Chief Information Security Officer
Which marking scheme labels media, and who sets it?	MP-3	The organization’s information handling labels (for example Public, Internal and Confidential), defined in an information classification or handling standard that the Chief Information Security Officer owns, with legally required markings added where they apply.	Chief Information Security Officer
Where are media stored, and how do they travel between sites?	MP-4, MP-5	A media library or locked cabinets in the data center, with an inventory reconciled each quarter; media leaving a controlled area are encrypted, packed in sealed, tamper-evident containers and carried by authorized staff or a tracked courier, with a chain-of-custody record.	System owner
Who sanitizes media, and is an outside sanitization or destruction provider used?	MP-6, MP-6(1), MP-6(2)	The IT operations team clears or purges media to be reused and keeps failed and retired media in a locked container; a contracted destruction provider destroys the rest and issues a certificate listing each device’s serial number; every action is recorded in the media sanitization record.	Chief Information Security Officer
How is information in cloud and other virtual storage sanitized when it is no longer needed?	MP-6	Cryptographic erase, by destroying the customer-managed keys under the encryption and key management standard, with the provider’s authorization or attestation covering sanitization of its physical media; recorded in the external service review.	System owner
Personnel or roles to whom the media protection policy is to be disseminated	MP-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the media protection procedures are to be disseminated	MP-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	MP-1	Organization-level	Chief Information Security Officer
An official to manage the media protection policy and procedures	MP-1	Chief Information Security Officer	Chief Information Security Officer
The frequency with which the current media protection policy is reviewed and updated	MP-1	Annually	Chief Information Security Officer
Events that would require the current media protection policy to be reviewed and updated	MP-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency with which the current media protection procedures are reviewed and updated	MP-1	Annually	Chief Information Security Officer
Events that would require media protection procedures to be reviewed and updated	MP-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Types of digital media to which access is restricted	MP-2	Removable and portable storage media (flash drives, external drives, memory cards and optical discs), backup media, and storage removed from service	Chief Information Security Officer
Personnel or roles authorized to access digital media	MP-2	Personnel whose access authorizations for the system permit access to the information on the media	Chief Information Security Officer
Types of non-digital media to which access is restricted	MP-2	Paper and microfilm containing information not approved for public release, including printed system output	Chief Information Security Officer
Personnel or roles authorized to access non-digital media	MP-2	Personnel whose access authorizations permit access to the information on the media	Chief Information Security Officer
Types of system media exempt from marking when remaining in controlled areas	MP-3	Backup media and drives held in automated tape libraries, storage arrays and server enclosures	Chief Information Security Officer
Controlled areas where media is exempt from marking	MP-3	The data center and the media library, where physical access is limited to authorized personnel (PE-3)	Chief Information Security Officer
Types of digital media to be physically controlled	MP-4	Removable and portable storage media, backup media, and storage removed from service and awaiting sanitization	Chief Information Security Officer
Types of non-digital media to be physically controlled	MP-4	Paper and microfilm containing information not approved for public release	Chief Information Security Officer
Types of digital media to be securely stored	MP-4	Removable and portable storage media, backup media, and storage removed from service and awaiting sanitization	Chief Information Security Officer
Types of non-digital media to be securely stored	MP-4	Paper and microfilm containing information not approved for public release	Chief Information Security Officer
Controlled areas within which to securely store digital media	MP-4	The data center, the media library, or a locked container in an area with physical access control, with access limited to authorized personnel	Chief Information Security Officer
Controlled areas within which to securely store non-digital media	MP-4	Locked cabinets, drawers or rooms with access limited to authorized personnel	Chief Information Security Officer
Types of system media to protect and control during transport outside of controlled areas	MP-5	All digital and non-digital media containing information not approved for public release	Chief Information Security Officer
Controls used to protect system media outside of controlled areas	MP-5	Encryption of digital media under the encryption and key management standard, and sealed, tamper-evident packaging or locked containers	Chief Information Security Officer
Controls used to control system media outside of controlled areas	MP-5	Transport only by authorized personnel or by a courier service with tracking and a signature on delivery, and a chain-of-custody record from release to receipt	Chief Information Security Officer
System media to be sanitized prior to disposal	MP-6	All digital and non-digital system media, including the storage in workstations, laptops, servers, network devices, mobile devices, printers, copiers and scanners	Chief Information Security Officer
System media to be sanitized prior to release from organizational control	MP-6	All digital and non-digital system media, including media returned to a lessor or vendor, exchanged under warranty, or sent off site for repair	Chief Information Security Officer
System media to be sanitized prior to release for reuse	MP-6	All digital system media reissued to another user, system or part of the organization	Chief Information Security Officer
Sanitization techniques and procedures to be used for sanitization prior to disposal	MP-6	Purge or destroy for digital media, and destruction by shredding or incineration for paper and other hard copy, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2	Chief Information Security Officer
Sanitization techniques and procedures to be used for sanitization prior to release from organizational control	MP-6	Purge, including cryptographic erase where its conditions are met, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2; media that cannot be purged and verified are destroyed, not released	Chief Information Security Officer
Sanitization techniques and procedures to be used for sanitization prior to release for reuse	MP-6	Clear for reuse within the same system or by users with the same access authorizations, and purge for other reuse, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2	Chief Information Security Officer
Types of system media to be restricted or prohibited from use on systems or system components	MP-7	Writable portable storage devices, such as USB flash drives, external hard drives and memory cards, and writable optical media	Chief Information Security Officer
Select one: restrict; prohibit	MP-7	Restrict	Chief Information Security Officer
Systems or system components on which the use of specific types of system media to be restricted or prohibited	MP-7	All organizational workstations, laptops and servers	Chief Information Security Officer
Controls to restrict or prohibit the use of specific types of system media on systems or system components	MP-7	Endpoint device control that blocks portable storage devices other than encrypted, organization-issued devices assigned to a named owner, with exceptions approved by the system owner and recorded	Chief Information Security Officer