Backups on a drive in an unlocked cabinet. A box of printed contracts in a shared office. A box of retired disks waiting for pickup. NIST SP 800-53 Rev 5 control MP-2 Media Access is the control that asks who can reach those things and whether you can prove the answer.
800-53 binds US federal systems and, through contract, some of their suppliers. For others it is a reference, and customers who ask about physical media handling will probably be asking an MP-2 question.
What the control asks
The statement is one sentence: restrict access to certain types of digital or non digital media to certain people or roles. You choose both blanks. The media types and the authorized roles are yours to define.
The guidance lists digital media (flash drives, diskettes, magnetic tapes, external or removable disks, optical discs) and non digital media (paper and microfilm). It gives a hospital example: patient records stay off limits unless the person is an authorized healthcare provider.
What it means in practice
Decide which media hold information that matters. For each type, write down who may touch it and how access is controlled. A locked cabinet with a keyholder list is a legitimate control. So is an encrypted drive where only some people hold the key.
The scope reaches past the data center. Printed reports, backup tapes sent to storage and old laptops count.
Think in terms of roles. A support agent probably needs no access to backup media. A sysadmin might. Paper HR files might be limited to two people.
Evidence to collect
- The list of media types in scope and the authorized roles for each.
- Key, badge or lock access lists for storage locations.
- Access logs from badge readers or key sign out sheets.
- Screenshots or exports of device control settings that block unapproved removable media.
- Records of periodic access reviews for media storage areas.
- Encryption key custody records where cryptographic protection is used.
Common gaps
The authorized list is longer than anyone realizes because it grew by favor. The storage cabinet is locked but the key hangs next to it. Printed material is treated as less sensitive than the same data on screen. Nobody reviews who has a key.
Another gap is the shared office. If media sit in an area many people enter, the room is not the control.
How to implement it
Inventory the media types you really have. Assign each a classification and an owner. Put physical media behind a lock with a short key list, and log use. Block or restrict removable storage on endpoints where you can.
Then review. Access reviews are not only for software accounts. The same discipline applies to a key list. The interactive demo shows how an access review works for system accounts, and the steps carry over.
Click through it at your own pace, or open it full screen.
Both enhancements, MP-2.1 Automated Restricted Access and MP-2.2 Cryptographic Protection, are marked withdrawn in the Rev 5 OSCAL catalog. Their intent now lives in other controls, so cite MP-2 itself and not the withdrawn numbers.
Quick check
Does MP-2 cover paper?
Yes. The guidance names paper and microfilm as non digital media.
Is a locked cabinet enough?
It can be, if the list of key holders matches the authorized roles and you can show who has used it.
