Someone finds a USB stick in the parking lot. It would be nice to know your systems will not accept it. NIST SP 800-53 Rev 5 control MP-7 Media Use is where that lives.
800-53 binds US federal systems and, through contracts, some suppliers. For others it is a reference, and a customer security review often asks how you handle removable storage.
What the control asks
Two parts. Restrict or prohibit the use of certain types of media on certain systems, using safeguards you choose. And prohibit portable storage devices that have no identifiable owner.
The guidance contrasts MP-7 with MP-2. MP-2 limits which users can access media. MP-7 limits which media can be used on a system at all. It also says the protections extend to mobile devices that can store data.
What it means in practice
Decide the policy per system class. A build server might block all removable drives. A designer laptop might allow approved encrypted ones. Enforce it with endpoint controls, not a memo. Then mark approved devices with an owner so unknown ones stand out.
Evidence to collect
- The media use policy by system class.
- Endpoint management settings that block or restrict removable storage.
- The register of approved portable devices with owners.
- Logs or alerts for blocked device attempts.
- Exceptions with approver and expiry.
Common gaps
The policy is written and nothing enforces it. Exceptions never expire. Personal phones used as storage are ignored.
How to implement it
Use device control in your endpoint tool, default deny, and allow by device and owner. The remaining active enhancement is MP-7.2 Prohibit Use of Sanitization resistant Media, which keeps media you cannot reliably wipe off your systems. MP-7.1 Prohibit Use Without Owner is withdrawn in Rev 5 and now sits in the base control.
Quick check
How is MP-7 different from MP-2?
MP-2 restricts user access to media. MP-7 restricts which media may be used on systems.
