MP.L2-3.8.5 Media Accountability
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Source: NIST SP 800-171 Rev 2 3.8.5
Discussion: Controlled areas are areas or spaces for which organizations provide physical or procedural controls to meet the requirements established for protecting systems and information. Controls to maintain accountability for media during transport include locked containers and cryptography. Cryptographic mechanisms can provide confidentiality and integrity protections depending upon the mechanisms used. Activities associated with transport include the actual transport as well as those activities such as releasing media for transport and ensuring that media enters the appropriate transport processes. For the actual transport, authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking and obtaining explicit records of transport activities as the media moves through the transportation system to prevent and detect loss, destruction, or tampering.
Assessment Objectives:
Determine if:
- [a] access to media containing CUI is controlled; and
- [b] accountability for media containing CUI is maintained during transport outside of controlled areas.
Examine: [SELECT FROM: System media protection policy; procedures addressing media storage; physical and environmental protection policy and procedures; access control policy and procedures; security plan; system media; designated controlled areas; other relevant documents or records].
Interview: [SELECT FROM: Personnel with system media protection and storage responsibilities; personnel with information security responsibilities; system or network administrators].
Test: [SELECT FROM: Organizational processes for storing media; mechanisms supporting or implementing media storage and media protection].
SPRS Score: 1
POA&M Allowed: Yes