Media Sanitization MP-6
Media Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds MP-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
MP-6 (Media Sanitization) requires sanitizing system media - disks, drives, tapes, and removable media - before disposal, release out of organizational control, or reuse, using techniques (clear, purge, or destroy) matched to the sensitivity of the data. The goal is that no recoverable data ever leaves on discarded or repurposed media.
What good looks like
- Sanitize media before disposal, release, or reuse.
- Choose the technique - clear, purge, or destroy - based on the security category of the data on the media.
- Verify and document that sanitization actually happened.
- Apply it to both fixed disks and removable media.
Framework mapping
- NIST CSF 2.0 — ID.AM-08 — Systems, hardware, software, services, and data are managed throughout their life cycles, including secure disposal
- CIS Controls v8 — Control 3.5 — Securely dispose of data
How to move it toward Implemented
- This is correctly tailored out at the host level: virtual machine (VM) 607 is a guest with no direct control of physical media - the underlying disks are the Proxmox host's and data center's responsibility, so MP-6 is inherited as a common control rather than implemented on PROD-WEB-01.
- It WOULD apply if this asset ever held its own physical disk, removable media, or a decommissioned virtual disk containing sensitive data - then you would
shred/wipe the virtual disk or physically destroy the media before reuse or disposal. - Record the inheritance in the System Security Plan: state that MP-6 is provided by the hosting environment and confirm the provider sanitizes underlying storage on VM deletion - that documents the tailoring instead of leaving a silent gap.