Media Use MP-7

Source: NIST SP 800-53 Rev.5, Media Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

MP-7 (Media Use) is about restricting — or flat-out prohibiting — the use of certain media on the system, and never allowing a portable storage device that has no identifiable owner. The classic case is the unknown USB (Universal Serial Bus) stick: an easy way to carry malware in or data out. On the Linux lab server this is enforced by controlling or disabling removable storage. It is a Low-baseline Media Protection control.

What good looks like

• Decide restrict vs. prohibit. Either limit removable media to approved devices or block it entirely — and write down which.
• Ban ownerless devices. No portable storage device with no identifiable owner may be used, full stop.
• Disable what you don’t need. If the server has no reason to use USB storage, turn it off.
• Mount removable media safely when it is allowed — no execution, no set-user-ID, no device files.
• Scan removable media for malware before its contents are trusted.

Framework mapping

• CIS Controls v8 — Control 3 — Data Protection
• CIS Controls v8 — Control 10 — Malware Defenses

How to move it toward Implemented

• If the server doesn’t need removable storage, disable it: add install usb-storage /bin/true to a file in /etc/modprobe.d/ and rebuild the initramfs, or enforce an allowlist with USBGuard.
• Where removable media is allowed, mount it noexec,nosuid,nodev (in /etc/fstab or the mount options) so it can’t run code or escalate privileges.
• Set a firm rule that ownerless devices are never used, and where supported scan mounted media with clamscan before trusting its contents.
• Attach the module-blacklist or USBGuard config plus the mount-hardening settings as hardening evidence on the asset, naming MP-7 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.