controlMP-4

Media Storage (MP-4)

Physically control and securely store [organization-defined] within [organization-defined] ; and Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

Security Baselines

MODERATEHIGHLOW

media-protectionsanitization

Why These Connect

Maps To2

These are equivalent or closely aligned requirements in other frameworks.

Baselined In2

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports35

These related controls work together — a change to one may affect the others.

Enhances2

These enhancements add specific capabilities or refinements to the base control.

Related Controls(22)

AC-3Access Enforcement (AC-3)

LMH

AC-19Access Control for Mobile Devices (AC-19)

LMH

AU-2Event Logging (AU-2)

LMH

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

LMH

AU-9Protection of Audit Information (AU-9)

LMH

AU-12Audit Record Generation (AU-12)

LMH

CP-2Contingency Plan (CP-2)

LMH

CP-6Alternate Storage Site (CP-6)

CP-9System Backup (CP-9)

LMH

MP-2Media Access (MP-2)

LMH

CP-10System Recovery and Reconstitution (CP-10)

LMH

MP-7Media Use (MP-7)

LMH

PE-3Physical Access Control (PE-3)

LMH

PL-2System Security and Privacy Plans (PL-2)

LMH

SC-12Cryptographic Key Establishment and Management (SC-12)

LMH

SC-13Cryptographic Protection (SC-13)

LMH

SC-28Protection of Information at Rest (SC-28)

SC-34Non-modifiable Executable Programs (SC-34)SI-12Information Management and Retention (SI-12)

LMH

MP-5Media Transport (MP-5)

PE-4Access Control for Transmission (PE-4)

RA-2Security Categorization (RA-2)

LMH

Cross-Framework Mappings(2)

ISO 27001ISO/IEC 27001:20224 mappingsFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule3 mappingsFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

Organization-Defined Parameters(6)

Assignmentorganization-defined types of digital media

Assignmentorganization-defined types of non-digital media

Assignmentorganization-defined types of digital media

Assignmentorganization-defined types of non-digital media

Assignmentorganization-defined controlled areas

Control Enhancements(2)

MP-4(1)Cryptographic Protection (MP-4(1))W

MP-4(2)Automated Restricted Access (MP-4(2))