Media Access MP-2

Media Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds MP-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MP-2 (Media Access) is about restricting who can get to media that holds the system’s data. It names the media types that matter — USB (Universal Serial Bus) drives, backup disks, tapes — and the roles allowed to touch them, so a random person (or a stray USB stick) cannot read or copy data. On the Linux lab server this comes down to controlling who can mount and read removable media. It is a Low-baseline Media Protection control.

What good looks like

List the media types the server uses (removable USB storage, backup drives) and who is allowed to access each.
Limit mounting of removable media to trusted accounts — don’t let every user auto-mount and read a USB drive.
Lock down the mount points and device files so file permissions and group membership decide who reads the media.
Keep unattended media out of reach — access control on paper means little if a drive sits in an open drawer.
Log media access where you can, so you can tell who read or wrote a drive.

Framework mapping

CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

Restrict removable-media mounting to admins: remove the udisks/polkit auto-mount permission for standard users, or set a noauto policy so only sudo-capable accounts mount drives.
Tighten device and mount-point permissions — keep /media and /mnt mounts owned by root with group access limited to a dedicated backup group via chown and chmod.
If removable storage isn’t needed at all, block it with USBGuard or a module blacklist (install usb-storage /bin/true in /etc/modprobe.d/), and record who is exempt.
Attach a dated record of the media types, the allowed roles, and the applied restrictions as hardening evidence on the asset, naming MP-2 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.