Media Marking MP-3
Media Protection · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds MP-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
MP-3 (Media Marking) asks you to mark media so anyone handling it can see how sensitive it is and how it must be handled — distribution limits, handling caveats, and any security markings. It also lets you exempt certain media from marking as long as it never leaves a controlled area. For the Linux lab server, ‘media’ is mainly backup disks, USB (Universal Serial Bus) drives, and exported data files. This is a Moderate-baseline control, so it applies once the system holds more sensitive data.
What good looks like
- Physically label removable media (backup disks, USB drives) with its sensitivity and handling rules so no one has to guess.
- Mark the data too, not just the case — a clear classification on exported files and backup archives travels with the data.
- Define your marking scheme once (for example, ‘Internal’ and ‘Confidential’) so labels stay consistent.
- Write down any exemptions — media that stays inside a controlled area — and name where that controlled area is.
- Keep marking simple and legible; a label no one can read protects nothing.
Framework mapping
How to move it toward Implemented
- Create a short media-marking scheme (the sensitivity levels you use and the handling rule for each) and keep it alongside the MP-1 procedures.
- Physically label backup disks and USB drives with their sensitivity level and any handling caveats, using a durable, legible label.
- For exported data, mark the files themselves — a classification banner line or a naming convention (for example, a
CONFIDENTIAL_filename prefix) so the marking travels with the file. - Document which media you exempt from marking and name the controlled area it must stay in.
- Attach the marking scheme plus a dated inventory (or photo) of labeled media as hardening evidence on the asset, naming
MP-3in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.