Media Storage MP-4

Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MP-4 (Media Storage) is about keeping media physically controlled and securely stored until it is destroyed or properly wiped. It covers where media lives (a locked, controlled area) and how the data on it is protected while it sits there. For the Linux lab server the strongest technical lever is encrypting data at rest, so a stolen disk is useless. This is a Moderate-baseline Media Protection control.

What good looks like

• Store media in a controlled area — a locked drawer, cabinet, or room — not on an open desk.
• Encrypt data at rest so the media is protected even if the physical control fails.
• Protect media until it is gone — keep it secured right up to the moment it is destroyed or sanitized with an approved method.
• Know what you hold — a simple inventory of stored disks and drives so nothing goes missing quietly.
• Limit and log access to the storage area where you can.

Framework mapping

How to move it toward Implemented

• Encrypt the server’s data disks and any backup media with LUKS (Linux Unified Key Setup) (cryptsetup luksFormat, then cryptsetup open); confirm with cryptsetup status and lsblk.
• Store backup disks and USB (Universal Serial Bus) drives in a locked, controlled location, and keep a short inventory of what is stored where.
• Define an approved sanitization method for retired media (for example, cryptsetup luksErase, or a full blkdiscard/shred) so media stays protected until it is truly gone.
• Attach the encryption-status output plus the storage-and-inventory note as hardening evidence on the asset, naming MP-4 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.