BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

MP-04 Media Storage

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged MP Moderate baselineHigh baseline

Title

Media Storage

Control

a. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas] ; and
b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection.

Parameters

mp-4_prm_1: organization-defined types of digital and/or non-digital media
mp-4_prm_2: organization-defined controlled areas
mp-04_odp.01: types of digital media
mp-04_odp.02: types of non-digital media
mp-04_odp.03: types of digital media
mp-04_odp.04: types of non-digital media
mp-04_odp.05: controlled areas
mp-04_odp.06: controlled areas

Related controls

ac-19, cp-10, cp-2, cp-6, cp-9, mp-2, mp-7, pe-3, pl-2, sc-12, sc-13, sc-28, sc-34, si-12

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).