Media Transport MP-5

Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MP-5 (Media Transport) covers what happens when media leaves the controlled area — a backup disk carried offsite, a USB (Universal Serial Bus) drive taken home. You protect and control it in transit, stay accountable for it, write down the trip, and let only authorized people move it. For the Linux lab server the key move is encrypting media before it travels. This is a Moderate-baseline Media Protection control.

What good looks like

• Encrypt before it moves. Media leaving the controlled area should be encrypted, so a loss in transit isn’t a data breach.
• Stay accountable. Know who holds the media, from pickup to drop-off.
• Log the trip. Record what media moved, when, by whom, and where it went.
• Authorize the courier. Only named, authorized people transport media.
• Use protective handling — a sealed, tracked container for anything sensitive.

Framework mapping

• CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

• Encrypt any media before transport with LUKS (Linux Unified Key Setup) (cryptsetup luksFormat) or, for single files, gpg --symmetric — never move sensitive data in the clear.
• Keep a media transport log — a dated file listing what moved, who carried it, and its destination — so accountability is provable.
• Name the authorized people allowed to transport media in the MP-1 procedures, and hand media off only to them.
• Attach the transport log (with proof the media was encrypted, for example cryptsetup status) as hardening evidence on the asset, naming MP-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.