A courier picks up backup tapes. An engineer carries a laptop and a spare drive to a client site. A box of retired disks goes to a recycler. NIST SP 800-53 Rev 5 control MP-5 Media Transport is about those trips.
800-53 binds US federal systems and, through contract, some suppliers. For others it is a reference, and it maps well to the questions about physical data movement that enterprise customers raise.
What the control asks
Four parts. Protect and control certain media during transport outside controlled areas using methods you define. Maintain accountability for the media in transit. Document transport activities. Restrict transport to authorized personnel.
The guidance says controlled areas are spaces where you have physical or procedural controls. Protection methods include cryptography and locked containers. Custodians may be employees or contracted couriers, and the guidance says to identify them.
What it means in practice
Know what leaves, who carries it, how it is protected and when it arrives. Encrypt the data so a lost drive is not a breach. Use sealed, tamper evident containers where it makes sense. Get a signature on receipt.
Evidence to collect
- The transport procedure and the list of authorized carriers.
- A shipment log with date, contents, carrier and recipient.
- Receipt confirmations.
- Encryption settings for transported drives.
- Contracts with couriers or storage vendors that cover custody.
Common gaps
Logs only cover tapes, not laptops or one off drives. Drives are encrypted but the key travels with them. A courier is used with no contract. Nobody can say who took a box.
How to implement it
Write a short checklist: label, encrypt, seal, log, hand over, confirm. Limit who may send. The one active enhancement is MP-5.3 Custodians, which asks you to employ an identified custodian during transport. MP-5.1 Protection Outside of Controlled Areas, MP-5.2 Documentation of Activities and MP-5.4 Cryptographic Protection are withdrawn in Rev 5 and folded into the base control.
Quick check
Does MP-5 apply to a laptop in a backpack?
If the laptop is system media within your defined scope and leaves a controlled area, yes. The control covers digital media moved outside controlled areas.
What does accountability mean here?
You can say who had the media, where it went and when it arrived.
