Domain 7 of 8 · Chapter 5 of 15

Resource Protection

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

  • The media-management program: custodian, inventory, accountability
  • Mechanics: the MP-family handling chain
  • Beyond media: protecting hardware, software, and virtual resources
  • Exam-pattern recognition: altitude and accountability

NIST SP 800-53 Media Protection (MP) family: operational handling chain

ControlWhat it governsOperational action
MP-2 Media AccessWho may handle mediaRestrict media access to authorized personnel/roles
MP-3 Media MarkingHandling caveats on mediaMark with distribution limits; may exempt media kept inside a controlled area
MP-4 Media StorageMedia at rest in the libraryPhysically control and securely store until reuse or destruction
MP-5 Media TransportMedia leaving a controlled areaProtect, document accountability, authorized couriers only
MP-6 Media SanitizationMedia at end of lifeSanitize before disposal/reuse (mechanics owned by data-lifecycle)
MP-7 Media UseDevice types allowed on systemsRestrict/prohibit types; ban portable storage with no identifiable owner

Decision tree

Resource leaving acontrolled area?YesMP-5 Media Transport:encrypt copy + authorized courierNoPortable storage devicein use on a system?YesMP-7 Media Use:prohibit devices with no identifiable ownerNoVM image or snapshot?(can carry full data + secrets)YesTreat as sensitive media:inventory, access-control, encryptNoIn the media library:MP-4 storage + MP-2 access, custodian check-in/outAlways: media custodian keeps an accurate inventory and accountable custody record
Cheat sheet

Cheat sheet

  • Media that cannot be accounted for cannot be protected
  • The media custodian runs the library; the data owner is accountable for classification
  • Run inventory plus check-in/check-out so any item's whereabouts is always known
  • NIST SP 800-53 MP family is the operational handling chain: mark, store, transport, use, sanitize
  • Media kept inside a controlled area may be exempted from marking
  • For media leaving a controlled area, encryption on the copy is the protection that survives loss
  • MP-5 transport requires documented accountability, not just secure carriage
  • MP-7 Media Use prohibits portable storage with no identifiable owner
  • Treat a VM image or snapshot as sensitive media in its own right
  • Protect hardware through inventory, physical access control, and maintenance discipline
  • Protect software by controlled distribution and integrity verification of the trusted copy
  • Operations triggers sanitization; the destruction mechanics live in asset security
  • Storage and transport controls tighten in lockstep with classification
  • Resource protection guards integrity and custody, not patch level

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. NIST SP 800-53 Rev 5 CM-8 System Component Inventory Whitepaper
  2. NIST SP 800-53 Rev 5 MP-2 Media Access Whitepaper
  3. NIST SP 800-53 Rev 5 MP-4 Media Storage Whitepaper
  4. NIST SP 800-53 Rev 5 Media Protection (MP) control family Whitepaper
  5. NIST SP 800-53 Rev 5 MP-3 Media Marking Whitepaper
  6. NIST SP 800-53 Rev 5 MP-5 Media Transport Whitepaper
  7. NIST SP 800-53 Rev 5 MP-7 Media Use Whitepaper
  8. NIST SP 800-53 Rev 5 MP-6 Media Sanitization Whitepaper
  9. NIST SP 800-88 Rev 1 Guidelines for Media Sanitization Whitepaper