[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fmp-3":3},{"item":4,"lessons":18,"controls":48,"related":63},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","mp-3","MP-3","Media Marking",7,"US National Institute of Standards and Technology (NIST)","**What it asks for.** System media must be marked with distribution limitations, handling caveats and applicable security markings, with defined exemptions for media kept within controlled areas.\n\n**In practice.** This means applying the organisation's information classification scheme to physical and removable media and, by extension, to digital documents through labels. Sensitivity labelling tools can automate marking for files and email. Auditors look for the classification policy, labelling configurations and samples of marked media. Labels should drive handling rules, such as encryption or blocking external sharing.\n\n**Common gaps.** Classification schemes exist on paper but labels are rarely applied consistently. Removable media is often unmarked, so its sensitivity is unknown when found or disposed of. Users may also misclassify data because labels are unclear.","a. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and\n  b. Exempt [Assignment: organization-defined types of media exempted from marking] from marking if the media remain within [Assignment: organization-defined controlled areas].\nDiscussion: Security marking refers to the application or use of human-readable security attributes. Digital media includes diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), flash drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Controlled unclassified information is defined by the National Archives and Records Administration along with the appropriate safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) . Security markings are generally not required for media that contains information determined by organizations to be in the public domain or to be publicly releasable. Some organizations may require markings for public information indicating that the information is publicly releasable. System media marking reflects applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"austrian-court-rules-unredacted-personal-data-in-government-legal-decisions-violates-privacy-law","Austrian Court Rules Unredacted Personal Data in Government Legal Decisions Violates Privacy Law","2026-09-22T10:20:54.159+00:00",{"slug":25,"title":26,"published_at":27},"italian-hospital-fined-10000-for-publishing-sensitive-recruitment-data-online","Italian Hospital Fined €10,000 for Publishing Sensitive Recruitment Data Online","2026-09-08T14:22:25.098+00:00",{"slug":29,"title":30,"published_at":31},"unredacted-court-judgment-shared-on-social-media-violates-data-privacy-rights","Unredacted Court Judgment Shared on Social Media Violates Data Privacy Rights","2026-08-02T16:20:21.902+00:00",{"slug":33,"title":34,"published_at":35},"italian-ministry-of-justice-fined-for-posting-employee-health-data-on-canteen-bulletin-board","Italian Ministry of Justice Fined for Posting Employee Health Data on Canteen Bulletin Board","2026-07-20T12:20:57.331+00:00",{"slug":37,"title":38,"published_at":39},"italian-ministry-of-justice-fined-for-publicly-exposing-employee-health-data","Italian Ministry of Justice Fined for Publicly Exposing Employee Health Data","2026-07-20T12:20:40.691+00:00",{"slug":41,"title":42,"published_at":43},"msg-vip-database-leak-exposes-sensitive-personal-categorizations","MSG VIP Database Leak Exposes Sensitive Personal Categorizations","2026-07-09T12:22:16.093+00:00",{"slug":45,"title":46,"published_at":47},"italian-red-cross-fined-for-exposing-hiv-status-on-meal-tray-note","Italian Red Cross Fined for Exposing HIV Status on Meal Tray Note","2026-07-07T10:20:34.046+00:00",[49,54,59],{"slug":50,"name":51,"problem":52,"stories":53},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",4,{"slug":55,"name":56,"problem":57,"stories":58},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":60,"name":61,"problem":62,"stories":58},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[64,69,74,79,84,88,92,97],{"family":65,"item":66,"code":67,"title":68,"together":9},"cis","3","Control 3","Data Protection",{"family":70,"item":71,"code":72,"title":73,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":70,"item":75,"code":76,"title":77,"together":78},"9","Article 9","Processing of special categories of personal data",6,{"family":65,"item":80,"code":81,"title":82,"together":83},"14","Control 14","Security Awareness and Skills Training",5,{"family":70,"item":85,"code":86,"title":87,"together":83},"25","Article 25","Data protection by design and by default",{"family":5,"item":89,"code":90,"title":91,"together":83},"ac-3","AC-3","Access Enforcement",{"family":70,"item":93,"code":94,"title":95,"together":96},"6","Article 6","Lawfulness of processing",3,{"family":98,"item":99,"code":100,"title":101,"together":96},"iso-27001","a-5-12","Annex A 5.12","ISO\u002FIEC 27001:2022 Annex A 5.12: Classification of information"]