Nist 800 53 Mp
| Field | Value |
|---|---|
| Type | Skill Resource |
| Source | ~/.copilot/skills/security/references/ato/nist-800-53-mp.json |
| Description | Not specified |
Source Content
{ "catalog_uuid": "ea7c7688-79c5-463b-a91b-0650f2d98623", "catalog_title": "Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures", "catalog_version": "5.2.0", "group": { "id": "mp", "class": "family", "title": "Media Protection", "props": [ { "name": "label", "value": "MP" } ], "controls": [ { "id": "mp-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "mp-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "mp-01_odp.01", "props": [ { "name": "label", "value": "MP-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the media protection policy is to be disseminated is/are defined;" } ] }, { "id": "mp-01_odp.02", "props": [ { "name": "label", "value": "MP-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the media protection procedures are to be disseminated is/are defined;" } ] }, { "id": "mp-01_odp.03", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_2" }, { "name": "label", "value": "MP-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "mp-01_odp.04", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_3" }, { "name": "label", "value": "MP-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the media protection policy and procedures is defined;" } ] }, { "id": "mp-01_odp.05", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_4" }, { "name": "label", "value": "MP-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current media protection policy is reviewed and updated is defined;" } ] }, { "id": "mp-01_odp.06", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_5" }, { "name": "label", "value": "MP-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current media protection policy to be reviewed and updated are defined;" } ] }, { "id": "mp-01_odp.07", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_6" }, { "name": "label", "value": "MP-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which the current media protection procedures are reviewed and updated is defined;" } ] }, { "id": "mp-01_odp.08", "props": [ { "name": "alt-identifier", "value": "mp-1_prm_7" }, { "name": "label", "value": "MP-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require media protection procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-01", "class": "zero-padded" }, { "name": "label", "value": "MP-1" }, { "name": "label", "value": "MP-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "mp-1_smt", "name": "statement", "parts": [ { "id": "mp-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, mp-1_prm_1 }}:", "parts": [ { "id": "mp-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "{{ insert: param, mp-01_odp.03 }} media protection policy that:", "parts": [ { "id": "mp-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "mp-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "mp-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the media protection policy and the associated media protection controls;" } ] }, { "id": "mp-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, mp-01_odp.04 }} to manage the development, documentation, and dissemination of the media protection policy and procedures; and" }, { "id": "mp-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current media protection:", "parts": [ { "id": "mp-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, mp-01_odp.05 }} and following {{ insert: param, mp-01_odp.06 }} ; and" }, { "id": "mp-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, mp-01_odp.07 }} and following {{ insert: param, mp-01_odp.08 }}." } ] } ] }, { "id": "mp-1_gdn", "name": "guidance", "prose": "Media protection policy and procedures address the controls in the MP family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of media protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to media protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "mp-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[01]", "class": "sp800-53a" } ], "prose": "a media protection policy is developed and documented;", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[02]", "class": "sp800-53a" } ], "prose": "the media protection policy is disseminated to {{ insert: param, mp-01_odp.01 }};", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[03]", "class": "sp800-53a" } ], "prose": "media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.[04]", "class": "sp800-53a" } ], "prose": "the media protection procedures are disseminated to {{ insert: param, mp-01_odp.02 }};", "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses purpose;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses scope;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses roles;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses responsibilities;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses management commitment;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy addresses coordination among organizational entities;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.03 }} media protection policy compliance;", "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01a.01(b)", "class": "sp800-53a" } ], "prose": "the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;", "links": [ { "href": "#mp-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.", "links": [ { "href": "#mp-1_smt.b", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current media protection policy is reviewed and updated {{ insert: param, mp-01_odp.05 }}; ", "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current media protection policy is reviewed and updated following {{ insert: param, mp-01_odp.06 }};", "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "mp-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current media protection procedures are reviewed and updated {{ insert: param, mp-01_odp.07 }}; ", "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "mp-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current media protection procedures are reviewed and updated following {{ insert: param, mp-01_odp.08 }}.", "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-1_smt", "rel": "assessment-for" } ] }, { "id": "mp-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Media protection policy and procedures\n\norganizational risk management strategy\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with media protection responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "mp-2", "class": "SP800-53", "title": "Media Access", "params": [ { "id": "mp-2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-02_odp.03" } ], "label": "organization-defined types of digital and/or non-digital media" }, { "id": "mp-2_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-02_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-02_odp.04" } ], "label": "organization-defined personnel or roles" }, { "id": "mp-02_odp.01", "props": [ { "name": "label", "value": "MP-02_ODP[01]", "class": "sp800-53a" } ], "label": "types of digital media", "guidelines": [ { "prose": "types of digital media to which access is restricted are defined;" } ] }, { "id": "mp-02_odp.02", "props": [ { "name": "label", "value": "MP-02_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles authorized to access digital media is/are defined;" } ] }, { "id": "mp-02_odp.03", "props": [ { "name": "label", "value": "MP-02_ODP[03]", "class": "sp800-53a" } ], "label": "types of non-digital media", "guidelines": [ { "prose": "types of non-digital media to which access is restricted are defined;" } ] }, { "id": "mp-02_odp.04", "props": [ { "name": "label", "value": "MP-02_ODP[04]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles authorized to access non-digital media is/are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-02", "class": "zero-padded" }, { "name": "label", "value": "MP-2" }, { "name": "label", "value": "MP-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#22f2d4f0-4365-4e88-a30d-275c1f5473ea", "rel": "reference" }, { "href": "#ac-19", "rel": "related" }, { "href": "#au-9", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-9", "rel": "related" }, { "href": "#cp-10", "rel": "related" }, { "href": "#ma-5", "rel": "related" }, { "href": "#mp-4", "rel": "related" }, { "href": "#mp-6", "rel": "related" }, { "href": "#pe-2", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#sc-12", "rel": "related" }, { "href": "#sc-13", "rel": "related" }, { "href": "#sc-34", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "mp-2_smt", "name": "statement", "prose": "Restrict access to {{ insert: param, mp-2_prm_1 }} to {{ insert: param, mp-2_prm_2 }}." }, { "id": "mp-2_gdn", "name": "guidance", "prose": "System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media." }, { "id": "mp-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-02", "class": "sp800-53a" } ], "parts": [ { "id": "mp-2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-02[01]", "class": "sp800-53a" } ], "prose": "access to {{ insert: param, mp-02_odp.01 }} is restricted to {{ insert: param, mp-02_odp.02 }};", "links": [ { "href": "#mp-2_smt", "rel": "assessment-for" } ] }, { "id": "mp-2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-02[02]", "class": "sp800-53a" } ], "prose": "access to {{ insert: param, mp-02_odp.03 }} is restricted to {{ insert: param, mp-02_odp.04 }}.", "links": [ { "href": "#mp-2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-2_smt", "rel": "assessment-for" } ] }, { "id": "mp-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media access restrictions\n\naccess control policy and procedures\n\nphysical and environmental protection policy and procedures\n\nmedia storage facilities\n\naccess control records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media protection responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for restricting information media\n\nmechanisms supporting and/or implementing media access restrictions" } ] } ], "controls": [ { "id": "mp-2.1", "class": "SP800-53-enhancement", "title": "Automated Restricted Access", "props": [ { "name": "label", "value": "MP-02(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-2(1)" }, { "name": "label", "value": "MP-02(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-02.01" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-4.2", "rel": "incorporated-into" } ] }, { "id": "mp-2.2", "class": "SP800-53-enhancement", "title": "Cryptographic Protection", "props": [ { "name": "label", "value": "MP-02(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-2(2)" }, { "name": "label", "value": "MP-02(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-02.02" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#sc-28.1", "rel": "incorporated-into" } ] } ] }, { "id": "mp-3", "class": "SP800-53", "title": "Media Marking", "params": [ { "id": "mp-03_odp.01", "props": [ { "name": "alt-identifier", "value": "mp-3_prm_1" }, { "name": "alt-label", "value": "types of system media", "class": "sp800-53" }, { "name": "label", "value": "MP-03_ODP[01]", "class": "sp800-53a" } ], "label": "types of media exempted from marking", "guidelines": [ { "prose": "types of system media exempt from marking when remaining in controlled areas are defined;" } ] }, { "id": "mp-03_odp.02", "props": [ { "name": "alt-identifier", "value": "mp-3_prm_2" }, { "name": "label", "value": "MP-03_ODP[02]", "class": "sp800-53a" } ], "label": "controlled areas", "guidelines": [ { "prose": "controlled areas where media is exempt from marking are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-03", "class": "zero-padded" }, { "name": "label", "value": "MP-3" }, { "name": "label", "value": "MP-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#34a5571f-e252-4309-a8a1-2fdb2faefbcd", "rel": "reference" }, { "href": "#91f992fb-f668-4c91-a50f-0f05b95ccee3", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#ac-16", "rel": "related" }, { "href": "#cp-9", "rel": "related" }, { "href": "#mp-5", "rel": "related" }, { "href": "#pe-22", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "mp-3_smt", "name": "statement", "parts": [ { "id": "mp-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and" }, { "id": "mp-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Exempt {{ insert: param, mp-03_odp.01 }} from marking if the media remain within {{ insert: param, mp-03_odp.02 }}." } ] }, { "id": "mp-3_gdn", "name": "guidance", "prose": "Security marking refers to the application or use of human-readable security attributes. Digital media includes diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), flash drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Controlled unclassified information is defined by the National Archives and Records Administration along with the appropriate safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) . Security markings are generally not required for media that contains information determined by organizations to be in the public domain or to be publicly releasable. Some organizations may require markings for public information indicating that the information is publicly releasable. System media marking reflects applicable laws, executive orders, directives, policies, regulations, standards, and guidelines." }, { "id": "mp-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-03", "class": "sp800-53a" } ], "parts": [ { "id": "mp-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-03a.", "class": "sp800-53a" } ], "prose": "system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information;", "links": [ { "href": "#mp-3_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-03b.", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-03_odp.01 }} remain within {{ insert: param, mp-03_odp.02 }}.", "links": [ { "href": "#mp-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-3_smt", "rel": "assessment-for" } ] }, { "id": "mp-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media marking\n\nphysical and environmental protection policy and procedures\n\nlist of system media marking security attributes\n\ndesignated controlled areas\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media protection and marking responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for marking information media\n\nmechanisms supporting and/or implementing media marking" } ] } ] }, { "id": "mp-4", "class": "SP800-53", "title": "Media Storage", "params": [ { "id": "mp-4_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.03" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.04" } ], "label": "organization-defined types of digital and/or non-digital media" }, { "id": "mp-4_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.05" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04_odp.06" } ], "label": "organization-defined controlled areas" }, { "id": "mp-04_odp.01", "props": [ { "name": "label", "value": "MP-04_ODP[01]", "class": "sp800-53a" } ], "label": "types of digital media", "guidelines": [ { "prose": "types of digital media to be physically controlled are defined (if selected);" } ] }, { "id": "mp-04_odp.02", "props": [ { "name": "label", "value": "MP-04_ODP[02]", "class": "sp800-53a" } ], "label": "types of non-digital media", "guidelines": [ { "prose": "types of non-digital media to be physically controlled are defined (if selected);" } ] }, { "id": "mp-04_odp.03", "props": [ { "name": "label", "value": "MP-04_ODP[03]", "class": "sp800-53a" } ], "label": "types of digital media", "guidelines": [ { "prose": "types of digital media to be securely stored are defined (if selected);" } ] }, { "id": "mp-04_odp.04", "props": [ { "name": "label", "value": "MP-04_ODP[04]", "class": "sp800-53a" } ], "label": "types of non-digital media", "guidelines": [ { "prose": "types of non-digital media to be securely stored are defined (if selected);" } ] }, { "id": "mp-04_odp.05", "props": [ { "name": "label", "value": "MP-04_ODP[05]", "class": "sp800-53a" } ], "label": "controlled areas", "guidelines": [ { "prose": "controlled areas within which to securely store digital media are defined;" } ] }, { "id": "mp-04_odp.06", "props": [ { "name": "label", "value": "MP-04_ODP[06]", "class": "sp800-53a" } ], "label": "controlled areas", "guidelines": [ { "prose": "controlled areas within which to securely store non-digital media are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-04", "class": "zero-padded" }, { "name": "label", "value": "MP-4" }, { "name": "label", "value": "MP-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#20957dbb-6a1e-40a2-b38a-66f67d33ac2e", "rel": "reference" }, { "href": "#0d083d8a-5cc6-46f1-8d79-3081d42bcb75", "rel": "reference" }, { "href": "#eef62b16-c796-4554-955c-505824135b8a", "rel": "reference" }, { "href": "#110e26af-4765-49e1-8740-6750f83fcda1", "rel": "reference" }, { "href": "#e7942589-e267-4a5a-a3d9-f39a7aae81f0", "rel": "reference" }, { "href": "#8306620b-1920-4d73-8b21-12008528595f", "rel": "reference" }, { "href": "#22f2d4f0-4365-4e88-a30d-275c1f5473ea", "rel": "reference" }, { "href": "#ac-19", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-6", "rel": "related" }, { "href": "#cp-9", "rel": "related" }, { "href": "#cp-10", "rel": "related" }, { "href": "#mp-2", "rel": "related" }, { "href": "#mp-7", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#sc-12", "rel": "related" }, { "href": "#sc-13", "rel": "related" }, { "href": "#sc-28", "rel": "related" }, { "href": "#sc-34", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "mp-4_smt", "name": "statement", "parts": [ { "id": "mp-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Physically control and securely store {{ insert: param, mp-4_prm_1 }} within {{ insert: param, mp-4_prm_2 }} ; and" }, { "id": "mp-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures." } ] }, { "id": "mp-4_gdn", "name": "guidance", "prose": "System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection." }, { "id": "mp-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04", "class": "sp800-53a" } ], "parts": [ { "id": "mp-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04a.[01]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-04_odp.01 }} are physically controlled;", "links": [ { "href": "#mp-4_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04a.[02]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-04_odp.02 }} are physically controlled;", "links": [ { "href": "#mp-4_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-4_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04a.[03]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-04_odp.03 }} are securely stored within {{ insert: param, mp-04_odp.05 }};", "links": [ { "href": "#mp-4_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-4_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04a.[04]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-04_odp.04 }} are securely stored within {{ insert: param, mp-04_odp.06 }};", "links": [ { "href": "#mp-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-4_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04b.", "class": "sp800-53a" } ], "prose": "system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.", "links": [ { "href": "#mp-4_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-4_smt", "rel": "assessment-for" } ] }, { "id": "mp-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media storage\n\nphysical and environmental protection policy and procedures\n\naccess control policy and procedures\n\nsystem media\n\ndesignated controlled areas\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media protection and storage responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for storing information media\n\nmechanisms supporting and/or implementing secure media storage/media protection" } ] } ], "controls": [ { "id": "mp-4.1", "class": "SP800-53-enhancement", "title": "Cryptographic Protection", "props": [ { "name": "label", "value": "MP-04(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-4(1)" }, { "name": "label", "value": "MP-04(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-04.01" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#sc-28.1", "rel": "incorporated-into" } ] }, { "id": "mp-4.2", "class": "SP800-53-enhancement", "title": "Automated Restricted Access", "params": [ { "id": "mp-4.2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04.02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04.02_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-04.02_odp.03" } ], "label": "organization-defined automated mechanisms" }, { "id": "mp-04.02_odp.01", "props": [ { "name": "label", "value": "MP-04(02)_ODP[01]", "class": "sp800-53a" } ], "label": "automated mechanisms", "guidelines": [ { "prose": "automated mechanisms to restrict access to media storage areas are defined;" } ] }, { "id": "mp-04.02_odp.02", "props": [ { "name": "label", "value": "MP-04(02)_ODP[02]", "class": "sp800-53a" } ], "label": "automated mechanisms", "guidelines": [ { "prose": "automated mechanisms to log access attempts to media storage areas are defined;" } ] }, { "id": "mp-04.02_odp.03", "props": [ { "name": "label", "value": "MP-04(02)_ODP[03]", "class": "sp800-53a" } ], "label": "automated mechanisms", "guidelines": [ { "prose": "automated mechanisms to log access granted to media storage areas are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-04(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-4(2)" }, { "name": "label", "value": "MP-04(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-04.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-4", "rel": "required" }, { "href": "#ac-3", "rel": "related" }, { "href": "#au-2", "rel": "related" }, { "href": "#au-6", "rel": "related" }, { "href": "#au-9", "rel": "related" }, { "href": "#au-12", "rel": "related" }, { "href": "#pe-3", "rel": "related" } ], "parts": [ { "id": "mp-4.2_smt", "name": "statement", "prose": "Restrict access to media storage areas and log access attempts and access granted using {{ insert: param, mp-4.2_prm_1 }}." }, { "id": "mp-4.2_gdn", "name": "guidance", "prose": "Automated mechanisms include keypads, biometric readers, or card readers on the external entries to media storage areas." }, { "id": "mp-4.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04(02)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-4.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04(02)[01]", "class": "sp800-53a" } ], "prose": "access to media storage areas is restricted using {{ insert: param, mp-04.02_odp.01 }};", "links": [ { "href": "#mp-4.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-4.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04(02)[02]", "class": "sp800-53a" } ], "prose": "access attempts to media storage areas are logged using {{ insert: param, mp-04.02_odp.02 }};", "links": [ { "href": "#mp-4.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-4.2_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-04(02)[03]", "class": "sp800-53a" } ], "prose": "access granted to media storage areas is logged using {{ insert: param, mp-04.02_odp.03 }}.", "links": [ { "href": "#mp-4.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-4.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-4.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-04(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media storage\n\naccess control policy and procedures\n\nphysical and environmental protection policy and procedures\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nmedia storage facilities\n\naccess control devices\n\naccess control records\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-4.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-04(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media protection and storage responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-4.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-04(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Automated mechanisms restricting access to media storage areas\n\nautomated mechanisms auditing access attempts and access granted to media storage areas" } ] } ] } ] }, { "id": "mp-5", "class": "SP800-53", "title": "Media Transport", "params": [ { "id": "mp-5_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-05_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-05_odp.03" } ], "label": "organization-defined controls" }, { "id": "mp-05_odp.01", "props": [ { "name": "alt-identifier", "value": "mp-5_prm_1" }, { "name": "label", "value": "MP-05_ODP[01]", "class": "sp800-53a" } ], "label": "types of system media", "guidelines": [ { "prose": "types of system media to protect and control during transport outside of controlled areas are defined;" } ] }, { "id": "mp-05_odp.02", "props": [ { "name": "label", "value": "MP-05_ODP[02]", "class": "sp800-53a" } ], "label": "controls", "guidelines": [ { "prose": "controls used to protect system media outside of controlled areas are defined;" } ] }, { "id": "mp-05_odp.03", "props": [ { "name": "label", "value": "MP-05_ODP[03]", "class": "sp800-53a" } ], "label": "controls", "guidelines": [ { "prose": "controls used to control system media outside of controlled areas are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-05", "class": "zero-padded" }, { "name": "label", "value": "MP-5" }, { "name": "label", "value": "MP-05", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#e72fde0b-6fc2-497e-a9db-d8fce5a11b8a", "rel": "reference" }, { "href": "#9be5d661-421f-41ad-854e-86f98b811891", "rel": "reference" }, { "href": "#ac-7", "rel": "related" }, { "href": "#ac-19", "rel": "related" }, { "href": "#cp-2", "rel": "related" }, { "href": "#cp-9", "rel": "related" }, { "href": "#mp-3", "rel": "related" }, { "href": "#mp-4", "rel": "related" }, { "href": "#pe-16", "rel": "related" }, { "href": "#pl-2", "rel": "related" }, { "href": "#sc-12", "rel": "related" }, { "href": "#sc-13", "rel": "related" }, { "href": "#sc-28", "rel": "related" }, { "href": "#sc-34", "rel": "related" } ], "parts": [ { "id": "mp-5_smt", "name": "statement", "parts": [ { "id": "mp-5_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Protect and control {{ insert: param, mp-05_odp.01 }} during transport outside of controlled areas using {{ insert: param, mp-5_prm_2 }};" }, { "id": "mp-5_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Maintain accountability for system media during transport outside of controlled areas;" }, { "id": "mp-5_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Document activities associated with the transport of system media; and" }, { "id": "mp-5_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Restrict the activities associated with the transport of system media to authorized personnel." } ] }, { "id": "mp-5_gdn", "name": "guidance", "prose": "System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs. Non-digital media includes microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural controls to meet requirements established for protecting information and systems. Controls to protect media during transport include cryptography and locked containers. Cryptographic mechanisms can provide confidentiality and integrity protections depending on the mechanisms implemented. Activities associated with media transport include releasing media for transport, ensuring that media enters the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking and/or obtaining records of transport activities as the media moves through the transportation system to prevent and detect loss, destruction, or tampering. Organizations establish documentation requirements for activities associated with the transport of system media in accordance with organizational assessments of risk. Organizations maintain the flexibility to define record-keeping methods for the different types of media transport as part of a system of transport-related records." }, { "id": "mp-5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05", "class": "sp800-53a" } ], "parts": [ { "id": "mp-5_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-5_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05a.[01]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-05_odp.01 }} are protected during transport outside of controlled areas using {{ insert: param, mp-05_odp.02 }};", "links": [ { "href": "#mp-5_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-5_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05a.[02]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-05_odp.01 }} are controlled during transport outside of controlled areas using {{ insert: param, mp-05_odp.03 }};", "links": [ { "href": "#mp-5_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-5_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-5_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05b.", "class": "sp800-53a" } ], "prose": "accountability for system media is maintained during transport outside of controlled areas;", "links": [ { "href": "#mp-5_smt.b", "rel": "assessment-for" } ] }, { "id": "mp-5_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05c.", "class": "sp800-53a" } ], "prose": "activities associated with the transport of system media are documented;", "links": [ { "href": "#mp-5_smt.c", "rel": "assessment-for" } ] }, { "id": "mp-5_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05d.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-5_obj.d-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05d.[01]", "class": "sp800-53a" } ], "prose": "personnel authorized to conduct media transport activities is/are identified;", "links": [ { "href": "#mp-5_smt.d", "rel": "assessment-for" } ] }, { "id": "mp-5_obj.d-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05d.[02]", "class": "sp800-53a" } ], "prose": "activities associated with the transport of system media are restricted to identified authorized personnel.", "links": [ { "href": "#mp-5_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-5_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-5_smt", "rel": "assessment-for" } ] }, { "id": "mp-5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-05-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media storage\n\nphysical and environmental protection policy and procedures\n\naccess control policy and procedures\n\nauthorized personnel list\n\nsystem media\n\ndesignated controlled areas\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-05-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media protection and storage responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-5_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-05-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for storing information media\n\nmechanisms supporting and/or implementing media storage/media protection" } ] } ], "controls": [ { "id": "mp-5.1", "class": "SP800-53-enhancement", "title": "Protection Outside of Controlled Areas", "props": [ { "name": "label", "value": "MP-05(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-5(1)" }, { "name": "label", "value": "MP-05(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-05.01" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-5", "rel": "incorporated-into" } ] }, { "id": "mp-5.2", "class": "SP800-53-enhancement", "title": "Documentation of Activities", "props": [ { "name": "label", "value": "MP-05(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-5(2)" }, { "name": "label", "value": "MP-05(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-05.02" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-5", "rel": "incorporated-into" } ] }, { "id": "mp-5.3", "class": "SP800-53-enhancement", "title": "Custodians", "props": [ { "name": "label", "value": "MP-05(03)", "class": "zero-padded" }, { "name": "label", "value": "MP-5(3)" }, { "name": "label", "value": "MP-05(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-05.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-5", "rel": "required" } ], "parts": [ { "id": "mp-5.3_smt", "name": "statement", "prose": "Employ an identified custodian during transport of system media outside of controlled areas." }, { "id": "mp-5.3_gdn", "name": "guidance", "prose": "Identified custodians provide organizations with specific points of contact during the media transport process and facilitate individual accountability. Custodial responsibilities can be transferred from one individual to another if an unambiguous custodian is identified." }, { "id": "mp-5.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05(03)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-5.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05(03)[01]", "class": "sp800-53a" } ], "prose": "a custodian to transport system media outside of controlled areas is identified;", "links": [ { "href": "#mp-5.3_smt", "rel": "assessment-for" } ] }, { "id": "mp-5.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-05(03)[02]", "class": "sp800-53a" } ], "prose": "the identified custodian is employed during the transport of system media outside of controlled areas.", "links": [ { "href": "#mp-5.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-5.3_smt", "rel": "assessment-for" } ] }, { "id": "mp-5.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-05(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media transport\n\nphysical and environmental protection policy and procedures\n\nsystem media transport records\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-5.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-05(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media transport responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-5.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-05(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for identifying and employing a custodian to transport media outside of controlled areas" } ] } ] }, { "id": "mp-5.4", "class": "SP800-53-enhancement", "title": "Cryptographic Protection", "props": [ { "name": "label", "value": "MP-05(04)", "class": "zero-padded" }, { "name": "label", "value": "MP-5(4)" }, { "name": "label", "value": "MP-05(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-05.04" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#sc-28.1", "rel": "incorporated-into" } ] } ] }, { "id": "mp-6", "class": "SP800-53", "title": "Media Sanitization", "params": [ { "id": "mp-6_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.02" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.03" } ], "label": "organization-defined system media" }, { "id": "mp-6_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.04" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.05" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06_odp.06" } ], "label": "organization-defined sanitization techniques and procedures" }, { "id": "mp-06_odp.01", "props": [ { "name": "label", "value": "MP-06_ODP[01]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to disposal is defined;" } ] }, { "id": "mp-06_odp.02", "props": [ { "name": "label", "value": "MP-06_ODP[02]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to release from organizational control is defined;" } ] }, { "id": "mp-06_odp.03", "props": [ { "name": "label", "value": "MP-06_ODP[03]", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized prior to release for reuse is defined;" } ] }, { "id": "mp-06_odp.04", "props": [ { "name": "label", "value": "MP-06_ODP[04]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to disposal are defined;" } ] }, { "id": "mp-06_odp.05", "props": [ { "name": "label", "value": "MP-06_ODP[05]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined;" } ] }, { "id": "mp-06_odp.06", "props": [ { "name": "label", "value": "MP-06_ODP[06]", "class": "sp800-53a" } ], "label": "sanitization techniques and procedures", "guidelines": [ { "prose": "sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-06", "class": "zero-padded" }, { "name": "label", "value": "MP-6" }, { "name": "label", "value": "MP-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#91f992fb-f668-4c91-a50f-0f05b95ccee3", "rel": "reference" }, { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c28ae9a8-1121-42a9-a85e-00cfcc9b9a94", "rel": "reference" }, { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#e72fde0b-6fc2-497e-a9db-d8fce5a11b8a", "rel": "reference" }, { "href": "#9be5d661-421f-41ad-854e-86f98b811891", "rel": "reference" }, { "href": "#a5b1d18d-e670-4586-9e6d-4a88b7ba3df6", "rel": "reference" }, { "href": "#0f66be67-85e7-4ca6-bd19-39453e9f4394", "rel": "reference" }, { "href": "#4c501da5-9d79-4cb6-ba80-97260e1ce327", "rel": "reference" }, { "href": "#df9f87e9-71e7-4c74-9ac3-3cabd4e92f21", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-7", "rel": "related" }, { "href": "#au-11", "rel": "related" }, { "href": "#ma-2", "rel": "related" }, { "href": "#ma-3", "rel": "related" }, { "href": "#ma-4", "rel": "related" }, { "href": "#ma-5", "rel": "related" }, { "href": "#pm-22", "rel": "related" }, { "href": "#si-12", "rel": "related" }, { "href": "#si-18", "rel": "related" }, { "href": "#si-19", "rel": "related" }, { "href": "#sr-11", "rel": "related" } ], "parts": [ { "id": "mp-6_smt", "name": "statement", "parts": [ { "id": "mp-6_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Sanitize {{ insert: param, mp-6_prm_1 }} prior to disposal, release out of organizational control, or release for reuse using {{ insert: param, mp-6_prm_2 }} ; and" }, { "id": "mp-6_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information." } ] }, { "id": "mp-6_gdn", "name": "guidance", "prose": "Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques\u2014including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction\u2014prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information." }, { "id": "mp-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[01]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-06_odp.01 }} is sanitized using {{ insert: param, mp-06_odp.04 }} prior to disposal;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[02]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-06_odp.02 }} is sanitized using {{ insert: param, mp-06_odp.05 }} prior to release from organizational control;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06a.[03]", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-06_odp.03 }} is sanitized using {{ insert: param, mp-06_odp.06 }} prior to release for reuse;", "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06b.", "class": "sp800-53a" } ], "prose": "sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.", "links": [ { "href": "#mp-6_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6_smt", "rel": "assessment-for" } ] }, { "id": "mp-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\napplicable federal standards and policies addressing media sanitization policy\n\nmedia sanitization records\n\nsystem audit records\n\nsystem design documentation\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nsystem configuration settings and associated documentation\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with media sanitization responsibilities\n\norganizational personnel with records retention and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media sanitization\n\nmechanisms supporting and/or implementing media sanitization" } ] } ], "controls": [ { "id": "mp-6.1", "class": "SP800-53-enhancement", "title": "Review, Approve, Track, Document, and Verify", "props": [ { "name": "label", "value": "MP-06(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(1)" }, { "name": "label", "value": "MP-06(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-6", "rel": "required" } ], "parts": [ { "id": "mp-6.1_smt", "name": "statement", "prose": "Review, approve, track, document, and verify media sanitization and disposal actions." }, { "id": "mp-6.1_gdn", "name": "guidance", "prose": "Organizations review and approve media to be sanitized to ensure compliance with records retention policies. Tracking and documenting actions include listing personnel who reviewed and approved sanitization and disposal actions, types of media sanitized, files stored on the media, sanitization methods used, date and time of the sanitization actions, personnel who performed the sanitization, verification actions taken and personnel who performed the verification, and the disposal actions taken. Organizations verify that the sanitization of the media was effective prior to disposal." }, { "id": "mp-6.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6.1_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)[01]", "class": "sp800-53a" } ], "prose": "media sanitization and disposal actions are reviewed;", "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.1_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)[02]", "class": "sp800-53a" } ], "prose": "media sanitization and disposal actions are approved;", "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.1_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)[03]", "class": "sp800-53a" } ], "prose": "media sanitization and disposal actions are tracked;", "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.1_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)[04]", "class": "sp800-53a" } ], "prose": "media sanitization and disposal actions are documented;", "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.1_obj-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(01)[05]", "class": "sp800-53a" } ], "prose": "media sanitization and disposal actions are verified.", "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nmedia sanitization and disposal records\n\nreview records for media sanitization and disposal actions\n\napprovals for media sanitization and disposal actions\n\ntracking records\n\nverification records\n\nsystem audit records\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-6.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media sanitization and disposal responsibilities\n\norganizational personnel with records retention and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-6.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media sanitization\n\nmechanisms supporting and/or implementing media sanitization\n\nmechanisms supporting and/or implementing verification of media sanitization" } ] } ] }, { "id": "mp-6.2", "class": "SP800-53-enhancement", "title": "Equipment Testing", "params": [ { "id": "mp-6.2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06.02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-06.02_odp.02" } ], "label": "organization-defined frequency" }, { "id": "mp-06.02_odp.01", "props": [ { "name": "label", "value": "MP-06(02)_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency with which to test sanitization equipment is defined;" } ] }, { "id": "mp-06.02_odp.02", "props": [ { "name": "label", "value": "MP-06(02)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency with which to test sanitization procedures is defined;" } ] } ], "props": [ { "name": "label", "value": "MP-06(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(2)" }, { "name": "label", "value": "MP-06(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-6", "rel": "required" } ], "parts": [ { "id": "mp-6.2_smt", "name": "statement", "prose": "Test sanitization equipment and procedures {{ insert: param, mp-6.2_prm_1 }} to ensure that the intended sanitization is being achieved." }, { "id": "mp-6.2_gdn", "name": "guidance", "prose": "Testing of sanitization equipment and procedures may be conducted by qualified and authorized external entities, including federal agencies or external service providers." }, { "id": "mp-6.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(02)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-6.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(02)[01]", "class": "sp800-53a" } ], "prose": "sanitization equipment is tested {{ insert: param, mp-06.02_odp.01 }} to ensure that the intended sanitization is being achieved;", "links": [ { "href": "#mp-6.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(02)[02]", "class": "sp800-53a" } ], "prose": "sanitization procedures are tested {{ insert: param, mp-06.02_odp.02 }} to ensure that the intended sanitization is being achieved.", "links": [ { "href": "#mp-6.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-6.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\nprocedures addressing testing of media sanitization equipment\n\nresults of media sanitization equipment and procedures testing\n\nsystem audit records\n\nrecords retention and disposition policy\n\nrecords retention and disposition procedures\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "mp-6.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media sanitization responsibilities\n\norganizational personnel with records retention and disposition responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] }, { "id": "mp-6.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media sanitization\n\nautomated mechanisms supporting and/or implementing media sanitization\n\nautomated mechanisms supporting and/or implementing media sanitization procedures\n\nsanitization equipment" } ] } ] }, { "id": "mp-6.3", "class": "SP800-53-enhancement", "title": "Nondestructive Techniques", "params": [ { "id": "mp-06.03_odp", "props": [ { "name": "alt-identifier", "value": "mp-6.3_prm_1" }, { "name": "alt-label", "value": "circumstances requiring sanitization of portable storage devices", "class": "sp800-53" }, { "name": "label", "value": "MP-06(03)_ODP", "class": "sp800-53a" } ], "label": "circumstances", "guidelines": [ { "prose": "circumstances requiring sanitization of portable storage devices are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-06(03)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(3)" }, { "name": "label", "value": "MP-06(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-6", "rel": "required" } ], "parts": [ { "id": "mp-6.3_smt", "name": "statement", "prose": "Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: {{ insert: param, mp-06.03_odp }}." }, { "id": "mp-6.3_gdn", "name": "guidance", "prose": "Portable storage devices include external or removable hard disk drives (e.g., solid state, magnetic), optical discs, magnetic or optical tapes, flash memory devices, flash memory cards, and other external or removable disks. Portable storage devices can be obtained from untrustworthy sources and contain malicious code that can be inserted into or transferred to organizational systems through USB ports or other entry portals. While scanning storage devices is recommended, sanitization provides additional assurance that such devices are free of malicious code. Organizations consider nondestructive sanitization of portable storage devices when the devices are purchased from manufacturers or vendors prior to initial use or when organizations cannot maintain a positive chain of custody for the devices." }, { "id": "mp-6.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(03)", "class": "sp800-53a" } ], "prose": "non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under {{ insert: param, mp-06.03_odp }}.", "links": [ { "href": "#mp-6.3_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\ninformation on portable storage devices for the system\n\nlist of circumstances requiring sanitization of portable storage devices\n\nmedia sanitization records\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-6.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media sanitization responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-6.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media sanitization of portable storage devices\n\nmechanisms supporting and/or implementing media sanitization" } ] } ] }, { "id": "mp-6.4", "class": "SP800-53-enhancement", "title": "Controlled Unclassified Information", "props": [ { "name": "label", "value": "MP-06(04)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(4)" }, { "name": "label", "value": "MP-06(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.04" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-6", "rel": "incorporated-into" } ] }, { "id": "mp-6.5", "class": "SP800-53-enhancement", "title": "Classified Information", "props": [ { "name": "label", "value": "MP-06(05)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(5)" }, { "name": "label", "value": "MP-06(05)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.05" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-6", "rel": "incorporated-into" } ] }, { "id": "mp-6.6", "class": "SP800-53-enhancement", "title": "Media Destruction", "props": [ { "name": "label", "value": "MP-06(06)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(6)" }, { "name": "label", "value": "MP-06(06)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.06" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-6", "rel": "incorporated-into" } ] }, { "id": "mp-6.7", "class": "SP800-53-enhancement", "title": "Dual Authorization", "params": [ { "id": "mp-06.07_odp", "props": [ { "name": "alt-identifier", "value": "mp-6.7_prm_1" }, { "name": "label", "value": "MP-06(07)_ODP", "class": "sp800-53a" } ], "label": "system media", "guidelines": [ { "prose": "system media to be sanitized using dual authorization is defined;" } ] } ], "props": [ { "name": "label", "value": "MP-06(07)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(7)" }, { "name": "label", "value": "MP-06(07)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-6", "rel": "required" }, { "href": "#ac-3", "rel": "related" }, { "href": "#mp-2", "rel": "related" } ], "parts": [ { "id": "mp-6.7_smt", "name": "statement", "prose": "Enforce dual authorization for the sanitization of {{ insert: param, mp-06.07_odp }}." }, { "id": "mp-6.7_gdn", "name": "guidance", "prose": "Organizations employ dual authorization to help ensure that system media sanitization cannot occur unless two technically qualified individuals conduct the designated task. Individuals who sanitize system media possess sufficient skills and expertise to determine if the proposed sanitization reflects applicable federal and organizational standards, policies, and procedures. Dual authorization also helps to ensure that sanitization occurs as intended, protecting against errors and false claims of having performed the sanitization actions. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals." }, { "id": "mp-6.7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(07)", "class": "sp800-53a" } ], "prose": "dual authorization for sanitization of {{ insert: param, mp-06.07_odp }} is enforced.", "links": [ { "href": "#mp-6.7_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06(07)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\ndual authorization policy and procedures\n\nlist of system media requiring dual authorization for sanitization\n\nauthorization records\n\nmedia sanitization records\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-6.7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06(07)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media sanitization responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-6.7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06(07)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes requiring dual authorization for media sanitization\n\nmechanisms supporting and/or implementing media sanitization\n\nmechanisms supporting and/or implementing dual authorization" } ] } ] }, { "id": "mp-6.8", "class": "SP800-53-enhancement", "title": "Remote Purging or Wiping of Information", "params": [ { "id": "mp-06.08_odp.01", "props": [ { "name": "alt-identifier", "value": "mp-6.8_prm_1" }, { "name": "label", "value": "MP-06(08)_ODP[01]", "class": "sp800-53a" } ], "label": "systems or system components", "guidelines": [ { "prose": "systems or system components to purge or wipe information either remotely or under specific conditions are defined;" } ] }, { "id": "mp-06.08_odp.02", "props": [ { "name": "alt-identifier", "value": "mp-6.8_prm_2" }, { "name": "label", "value": "MP-06(08)_ODP[02]", "class": "sp800-53a" } ], "select": { "choice": [ "remotely", "under {{ insert: param, mp-06.08_odp.03 }} " ] } }, { "id": "mp-06.08_odp.03", "props": [ { "name": "alt-identifier", "value": "mp-6.8_prm_3" }, { "name": "label", "value": "MP-06(08)_ODP[03]", "class": "sp800-53a" } ], "label": "conditions", "guidelines": [ { "prose": "conditions under which information is to be purged or wiped are defined (if selected);" } ] } ], "props": [ { "name": "label", "value": "MP-06(08)", "class": "zero-padded" }, { "name": "label", "value": "MP-6(8)" }, { "name": "label", "value": "MP-06(08)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-06.08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-6", "rel": "required" } ], "parts": [ { "id": "mp-6.8_smt", "name": "statement", "prose": "Provide the capability to purge or wipe information from {{ insert: param, mp-06.08_odp.01 }} {{ insert: param, mp-06.08_odp.02 }}." }, { "id": "mp-6.8_gdn", "name": "guidance", "prose": "Remote purging or wiping of information protects information on organizational systems and system components if systems or components are obtained by unauthorized individuals. Remote purge or wipe commands require strong authentication to help mitigate the risk of unauthorized individuals purging or wiping the system, component, or device. The purge or wipe function can be implemented in a variety of ways, including by overwriting data or information multiple times or by destroying the key necessary to decrypt encrypted data." }, { "id": "mp-6.8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-06(08)", "class": "sp800-53a" } ], "prose": "the capability to purge or wipe information from {{ insert: param, mp-06.08_odp.01 }} {{ insert: param, mp-06.08_odp.02 }} is provided.", "links": [ { "href": "#mp-6.8_smt", "rel": "assessment-for" } ] }, { "id": "mp-6.8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-06(08)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media sanitization and disposal\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\nauthorization records\n\nmedia sanitization records\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-6.8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-06(08)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media sanitization responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-6.8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-06(08)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for purging/wiping media\n\nmechanisms supporting and/or implementing purge/wipe capabilities" } ] } ] } ] }, { "id": "mp-7", "class": "SP800-53", "title": "Media Use", "params": [ { "id": "mp-07_odp.01", "props": [ { "name": "alt-identifier", "value": "mp-7_prm_2" }, { "name": "label", "value": "MP-07_ODP[01]", "class": "sp800-53a" } ], "label": "types of system media", "guidelines": [ { "prose": "types of system media to be restricted or prohibited from use on systems or system components are defined;" } ] }, { "id": "mp-07_odp.02", "props": [ { "name": "alt-identifier", "value": "mp-7_prm_1" }, { "name": "label", "value": "MP-07_ODP[02]", "class": "sp800-53a" } ], "select": { "choice": [ "restrict", "prohibit" ] } }, { "id": "mp-07_odp.03", "props": [ { "name": "alt-identifier", "value": "mp-7_prm_3" }, { "name": "label", "value": "MP-07_ODP[03]", "class": "sp800-53a" } ], "label": "systems or system components", "guidelines": [ { "prose": "systems or system components on which the use of specific types of system media to be restricted or prohibited are defined;" } ] }, { "id": "mp-07_odp.04", "props": [ { "name": "alt-identifier", "value": "mp-7_prm_4" }, { "name": "label", "value": "MP-07_ODP[04]", "class": "sp800-53a" } ], "label": "controls", "guidelines": [ { "prose": "controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;" } ] } ], "props": [ { "name": "label", "value": "MP-07", "class": "zero-padded" }, { "name": "label", "value": "MP-7" }, { "name": "label", "value": "MP-07", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-07" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#628d22a1-6a11-4784-bc59-5cd9497b5445", "rel": "reference" }, { "href": "#22f2d4f0-4365-4e88-a30d-275c1f5473ea", "rel": "reference" }, { "href": "#ac-19", "rel": "related" }, { "href": "#ac-20", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-12", "rel": "related" }, { "href": "#sc-34", "rel": "related" }, { "href": "#sc-41", "rel": "related" } ], "parts": [ { "id": "mp-7_smt", "name": "statement", "parts": [ { "id": "mp-7_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "{{ insert: param, mp-07_odp.02 }} the use of {{ insert: param, mp-07_odp.01 }} on {{ insert: param, mp-07_odp.03 }} using {{ insert: param, mp-07_odp.04 }} ; and" }, { "id": "mp-7_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner." } ] }, { "id": "mp-7_gdn", "name": "guidance", "prose": "System media includes both digital and non-digital media. Digital media includes diskettes, magnetic tapes, flash drives, compact discs, digital versatile discs, and removable hard disk drives. Non-digital media includes paper and microfilm. Media use protections also apply to mobile devices with information storage capabilities. In contrast to [MP-2](#mp-2) , which restricts user access to media, MP-7 restricts the use of certain types of media on systems, for example, restricting or prohibiting the use of flash drives or external hard disk drives. Organizations use technical and nontechnical controls to restrict the use of system media. Organizations may restrict the use of portable storage devices, for example, by using physical cages on workstations to prohibit access to certain external ports or disabling or removing the ability to insert, read, or write to such devices. Organizations may also limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Finally, organizations may restrict the use of portable storage devices based on the type of device, such as by prohibiting the use of writeable, portable storage devices and implementing this restriction by disabling or removing the capability to write to such devices. Requiring identifiable owners for storage devices reduces the risk of using such devices by allowing organizations to assign responsibility for addressing known vulnerabilities in the devices." }, { "id": "mp-7_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07", "class": "sp800-53a" } ], "parts": [ { "id": "mp-7_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07a.", "class": "sp800-53a" } ], "prose": "the use of {{ insert: param, mp-07_odp.01 }} is {{ insert: param, mp-07_odp.02 }} on {{ insert: param, mp-07_odp.03 }} using {{ insert: param, mp-07_odp.04 }};", "links": [ { "href": "#mp-7_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-7_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07b.", "class": "sp800-53a" } ], "prose": "the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.", "links": [ { "href": "#mp-7_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-7_smt", "rel": "assessment-for" } ] }, { "id": "mp-7_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-07-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nsystem use policy\n\nprocedures addressing media usage restrictions\n\nrules of behavior\n\nsystem design documentation\n\nsystem configuration settings and associated documentation\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-7_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-07-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media use responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-7_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-07-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media use\n\nmechanisms restricting or prohibiting the use of system media on systems or system components" } ] } ], "controls": [ { "id": "mp-7.1", "class": "SP800-53-enhancement", "title": "Prohibit Use Without Owner", "props": [ { "name": "label", "value": "MP-07(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-7(1)" }, { "name": "label", "value": "MP-07(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-07.01" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#mp-7", "rel": "incorporated-into" } ] }, { "id": "mp-7.2", "class": "SP800-53-enhancement", "title": "Prohibit Use of Sanitization-resistant Media", "props": [ { "name": "label", "value": "MP-07(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-7(2)" }, { "name": "label", "value": "MP-07(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-07.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-7", "rel": "required" }, { "href": "#mp-6", "rel": "related" } ], "parts": [ { "id": "mp-7.2_smt", "name": "statement", "prose": "Prohibit the use of sanitization-resistant media in organizational systems." }, { "id": "mp-7.2_gdn", "name": "guidance", "prose": "Sanitization resistance refers to how resistant media are to non-destructive sanitization techniques with respect to the capability to purge information from media. Certain types of media do not support sanitization commands, or if supported, the interfaces are not supported in a standardized way across these devices. Sanitization-resistant media includes compact flash, embedded flash on boards and devices, solid state drives, and USB removable media." }, { "id": "mp-7.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07(02)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-7.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07(02)[01]", "class": "sp800-53a" } ], "prose": "sanitization-resistant media is identified;", "links": [ { "href": "#mp-7.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-7.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-07(02)[02]", "class": "sp800-53a" } ], "prose": "the use of sanitization-resistant media in organizational systems is prohibited.", "links": [ { "href": "#mp-7.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-7.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-7.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-07(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nsystem use policy\n\nprocedures addressing media usage restrictions\n\nrules of behavior\n\nsystem configuration settings and associated documentation\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-7.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-07(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media use responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-7.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-07(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media use\n\nmechanisms prohibiting use of media on systems or system components" } ] } ] } ] }, { "id": "mp-8", "class": "SP800-53", "title": "Media Downgrading", "params": [ { "id": "mp-08_odp.01", "props": [ { "name": "alt-identifier", "value": "mp-8_prm_1" }, { "name": "label", "value": "MP-08_ODP[01]", "class": "sp800-53a" } ], "label": "system media downgrading process", "guidelines": [ { "prose": "a system media downgrading process is defined;" } ] }, { "id": "mp-08_odp.02", "props": [ { "name": "alt-identifier", "value": "mp-8_prm_2" }, { "name": "label", "value": "MP-08_ODP[02]", "class": "sp800-53a" } ], "label": "system media requiring downgrading", "guidelines": [ { "prose": "system media requiring downgrading is defined;" } ] } ], "props": [ { "name": "label", "value": "MP-08", "class": "zero-padded" }, { "name": "label", "value": "MP-8" }, { "name": "label", "value": "MP-08", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-08" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#91f992fb-f668-4c91-a50f-0f05b95ccee3", "rel": "reference" }, { "href": "#df9f87e9-71e7-4c74-9ac3-3cabd4e92f21", "rel": "reference" } ], "parts": [ { "id": "mp-8_smt", "name": "statement", "parts": [ { "id": "mp-8_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Establish {{ insert: param, mp-08_odp.01 }} that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;" }, { "id": "mp-8_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;" }, { "id": "mp-8_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Identify {{ insert: param, mp-08_odp.02 }} ; and" }, { "id": "mp-8_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Downgrade the identified system media using the established process." } ] }, { "id": "mp-8_gdn", "name": "guidance", "prose": "Media downgrading applies to digital and non-digital media subject to release outside of the organization, whether the media is considered removable or not. When applied to system media, the downgrading process removes information from the media, typically by security category or classification level, such that the information cannot be retrieved or reconstructed. Downgrading of media includes redacting information to enable wider release and distribution. Downgrading ensures that empty space on the media is devoid of information." }, { "id": "mp-8_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08a.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08a.[01]", "class": "sp800-53a" } ], "prose": "a {{ insert: param, mp-08_odp.01 }} is established;", "links": [ { "href": "#mp-8_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-8_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08a.[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, mp-08_odp.01 }} includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;", "links": [ { "href": "#mp-8_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8_smt.a", "rel": "assessment-for" } ] }, { "id": "mp-8_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08b.", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08b.[01]", "class": "sp800-53a" } ], "prose": "there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed;", "links": [ { "href": "#mp-8_smt.b", "rel": "assessment-for" } ] }, { "id": "mp-8_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08b.[02]", "class": "sp800-53a" } ], "prose": "there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information;", "links": [ { "href": "#mp-8_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8_smt.b", "rel": "assessment-for" } ] }, { "id": "mp-8_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08c.", "class": "sp800-53a" } ], "prose": "{{ insert: param, mp-08_odp.02 }} is identified;", "links": [ { "href": "#mp-8_smt.c", "rel": "assessment-for" } ] }, { "id": "mp-8_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08d.", "class": "sp800-53a" } ], "prose": "the identified system media is downgraded using the {{ insert: param, mp-08_odp.01 }}.", "links": [ { "href": "#mp-8_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8_smt", "rel": "assessment-for" } ] }, { "id": "mp-8_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-08-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media downgrading\n\nsystem categorization documentation\n\nlist of media requiring downgrading\n\nrecords of media downgrading\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-8_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-08-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media downgrading responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-8_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-08-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media downgrading\n\nmechanisms supporting and/or implementing media downgrading" } ] } ], "controls": [ { "id": "mp-8.1", "class": "SP800-53-enhancement", "title": "Documentation of Process", "props": [ { "name": "label", "value": "MP-08(01)", "class": "zero-padded" }, { "name": "label", "value": "MP-8(1)" }, { "name": "label", "value": "MP-08(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-08.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-8", "rel": "required" } ], "parts": [ { "id": "mp-8.1_smt", "name": "statement", "prose": "Document system media downgrading actions." }, { "id": "mp-8.1_gdn", "name": "guidance", "prose": "Organizations can document the media downgrading process by providing information, such as the downgrading technique employed, the identification number of the downgraded media, and the identity of the individual that authorized and/or performed the downgrading action." }, { "id": "mp-8.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(01)", "class": "sp800-53a" } ], "prose": "system media downgrading actions are documented.", "links": [ { "href": "#mp-8.1_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-08(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media downgrading\n\nsystem categorization documentation\n\nlist of media requiring downgrading\n\nrecords of media downgrading\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-8.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-08(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media downgrading responsibilities\n\norganizational personnel with information security responsibilities\n\nsystem/network administrators" } ] }, { "id": "mp-8.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-08(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media downgrading\n\nmechanisms supporting and/or implementing media downgrading" } ] } ] }, { "id": "mp-8.2", "class": "SP800-53-enhancement", "title": "Equipment Testing", "params": [ { "id": "mp-8.2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-08.02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "mp-08.02_odp.02" } ], "label": "organization-defined frequency" }, { "id": "mp-08.02_odp.01", "props": [ { "name": "label", "value": "MP-08(02)_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which to test downgrading equipment is defined;" } ] }, { "id": "mp-08.02_odp.02", "props": [ { "name": "label", "value": "MP-08(02)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency with which to test downgrading procedures is defined;" } ] } ], "props": [ { "name": "label", "value": "MP-08(02)", "class": "zero-padded" }, { "name": "label", "value": "MP-8(2)" }, { "name": "label", "value": "MP-08(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-08.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-8", "rel": "required" } ], "parts": [ { "id": "mp-8.2_smt", "name": "statement", "prose": "Test downgrading equipment and procedures {{ insert: param, mp-8.2_prm_1 }} to ensure that downgrading actions are being achieved." }, { "id": "mp-8.2_gdn", "name": "guidance", "prose": "None." }, { "id": "mp-8.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(02)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(02)[01]", "class": "sp800-53a" } ], "prose": "downgrading equipment is tested {{ insert: param, mp-08.02_odp.01 }} to ensure that downgrading actions are being achieved;", "links": [ { "href": "#mp-8.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(02)[02]", "class": "sp800-53a" } ], "prose": "downgrading procedures are tested {{ insert: param, mp-08.02_odp.02 }} to ensure that downgrading actions are being achieved.", "links": [ { "href": "#mp-8.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8.2_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-08(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\nprocedures addressing media downgrading\n\nprocedures addressing testing of media downgrading equipment\n\nresults of downgrading equipment and procedures testing\n\nrecords of media downgrading\n\naudit records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-8.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-08(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media downgrading responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-8.2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-08(02)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media downgrading\n\nmechanisms supporting and/or implementing media downgrading" } ] } ] }, { "id": "mp-8.3", "class": "SP800-53-enhancement", "title": "Controlled Unclassified Information", "props": [ { "name": "label", "value": "MP-08(03)", "class": "zero-padded" }, { "name": "label", "value": "MP-8(3)" }, { "name": "label", "value": "MP-08(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-08.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-8", "rel": "required" } ], "parts": [ { "id": "mp-8.3_smt", "name": "statement", "prose": "Downgrade system media containing controlled unclassified information prior to public release." }, { "id": "mp-8.3_gdn", "name": "guidance", "prose": "The downgrading of controlled unclassified information uses approved sanitization tools, techniques, and procedures." }, { "id": "mp-8.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(03)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(03)[01]", "class": "sp800-53a" } ], "prose": "system media containing controlled unclassified information is identified;", "links": [ { "href": "#mp-8.3_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(03)[02]", "class": "sp800-53a" } ], "prose": "system media containing controlled unclassified information is downgraded prior to public release.", "links": [ { "href": "#mp-8.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8.3_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-08(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\naccess authorization policy\n\nprocedures addressing downgrading of media containing CUI\n\napplicable federal and organizational standards and policies regarding protection of CUI\n\nmedia downgrading records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-8.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-08(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media downgrading responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-8.3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-08(03)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media downgrading\n\nmechanisms supporting and/or implementing media downgrading" } ] } ] }, { "id": "mp-8.4", "class": "SP800-53-enhancement", "title": "Classified Information", "props": [ { "name": "label", "value": "MP-08(04)", "class": "zero-padded" }, { "name": "label", "value": "MP-8(4)" }, { "name": "label", "value": "MP-08(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "mp-08.04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" } ], "links": [ { "href": "#mp-8", "rel": "required" } ], "parts": [ { "id": "mp-8.4_smt", "name": "statement", "prose": "Downgrade system media containing classified information prior to release to individuals without required access authorizations." }, { "id": "mp-8.4_gdn", "name": "guidance", "prose": "Downgrading of classified information uses approved sanitization tools, techniques, and procedures to transfer information confirmed to be unclassified from classified systems to unclassified media." }, { "id": "mp-8.4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(04)", "class": "sp800-53a" } ], "parts": [ { "id": "mp-8.4_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(04)[01]", "class": "sp800-53a" } ], "prose": "system media containing classified information is identified;", "links": [ { "href": "#mp-8.4_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.4_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "MP-08(04)[02]", "class": "sp800-53a" } ], "prose": "system media containing classified information is downgraded prior to release to individuals without required access authorizations.", "links": [ { "href": "#mp-8.4_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#mp-8.4_smt", "rel": "assessment-for" } ] }, { "id": "mp-8.4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "MP-08(04)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System media protection policy\n\naccess authorization policy\n\nprocedures addressing downgrading of media containing classified information\n\nprocedures addressing handling of classified information\n\nNSA standards and policies regarding protection of classified information\n\nmedia downgrading records\n\nsystem security plan\n\nother relevant documents or records" } ] }, { "id": "mp-8.4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "MP-08(04)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with system media downgrading responsibilities\n\norganizational personnel with information security responsibilities" } ] }, { "id": "mp-8.4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "MP-08(04)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational processes for media downgrading\n\nmechanisms supporting and/or implementing media downgrading" } ] } ] } ] } ] }}