THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · MP-3

Media Marking

US National Institute of Standards and Technology (NIST) · cited in 7 of our lessons

Explanation

What it asks for. System media must be marked with distribution limitations, handling caveats and applicable security markings, with defined exemptions for media kept within controlled areas.

In practice. This means applying the organisation's information classification scheme to physical and removable media and, by extension, to digital documents through labels. Sensitivity labelling tools can automate marking for files and email. Auditors look for the classification policy, labelling configurations and samples of marked media. Labels should drive handling rules, such as encryption or blocking external sharing.

Common gaps. Classification schemes exist on paper but labels are rarely applied consistently. Removable media is often unmarked, so its sensitivity is unknown when found or disposed of. Users may also misclassify data because labels are unclear.

Open SP 800-53 at NIST
The official text
a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and b. Exempt [Assignment: organization-defined types of media exempted from marking] from marking if the media remain within [Assignment: organization-defined controlled areas]. Discussion: Security marking refers to the application or use of human-readable security attributes. Digital media includes diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), flash drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Controlled unclassified information is defined by the National Archives and Records Administration along with the appropriate safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) . Security markings are generally not required for media that contains information determined by organizations to be in the public domain or to be publicly releasable. Some organizations may require markings for public information indicating that the information is publicly releasable. System media marking reflects applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.