Where do the backup drives sleep at night? NIST SP 800-53 Rev 5 control MP-4 Media Storage asks you to physically control and securely store defined types of media within defined controlled areas, and to protect that media until it is destroyed or sanitized using approved methods.
800-53 binds US federal systems and, by contract, some suppliers. For everyone else it is a reference, and storage questions turn up in vendor security questionnaires.
What it means in practice
The guidance says physical control includes inventories, a way for people to check media out and return it, and accountability for what is stored. Security measures can include locked containers, safes and secure rooms.
Protection continues until sanitization or destruction. A drive marked for disposal that sits on a shelf is still in scope.
Evidence to collect
- The inventory of stored media with location and owner.
- The checkout and return log.
- Lock, safe or room access lists.
- Photos or walkthrough notes of the storage area.
- Disposal queue records showing what is waiting for destruction.
Common gaps
An inventory that was accurate once. A shelf of retired drives nobody counted. A storage room shared with facilities staff. Checkout is by memory.
How to implement it
Pick one storage place per media type. Make it lockable and log entries. Count the contents quarterly and reconcile with the log. Keep a clearly separate bin for items waiting for sanitization under MP-6.
MP-4.2 Automated Restricted Access is the active enhancement, and it asks for automated mechanisms to restrict access to storage areas and audit attempts. MP-4.1 Cryptographic Protection is withdrawn in Rev 5. Encrypting stored drives is still the easiest protection to add.
Media you cannot account for are a risk. If you track risks formally, a media storage gap belongs in the register.
Click through it at your own pace, or open it full screen.
Quick check
Does protection end when media is retired?
No. MP-4 requires protection until the media is destroyed or sanitized.
