[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fmp-4":3},{"item":4,"lessons":18,"controls":48,"related":74},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","mp-4","MP-4","Media Storage",7,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Defined types of digital and non-digital media must be physically controlled and securely stored within controlled areas and protected until destroyed or sanitised.\n\n**In practice.** Doing this well means locked storage for removable media, backup tapes and sensitive paper records, access limited to authorised staff, and logs or inventories for high-value media. Off-site storage should use vetted providers. Auditors look for storage locations, access controls and media inventories. Clean desk rules and lockable cabinets support this in offices. Encryption reduces the impact when media is lost.\n\n**Common gaps.** Removable media and printed sensitive documents are often left in unsecured offices. Backup media sent off-site is not always tracked through its lifecycle. Media held by third parties is seldom checked.","a. Physically control and securely store [Assignment: organization-defined organization-defined types of digital and\u002For non-digital media] within [Assignment: organization-defined organization-defined controlled areas] ; and\n  b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures.\nDiscussion: System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the library, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. The type of media storage is commensurate with the security category or classification of the information on the media. Controlled areas are spaces that provide physical and procedural controls to meet the requirements established for protecting information and systems. Fewer controls may be needed for media that contains information determined to be in the public domain, publicly releasable, or have limited adverse impacts on organizations, operations, or individuals if accessed by other than authorized personnel. In these situations, physical access controls provide adequate protection.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"advantest-ransomware-attack-exposes-pii-including-ssns-and-financial-data","Advantest Ransomware Attack Exposes PII Including SSNs and Financial Data","2026-10-07T12:21:12.164+00:00",{"slug":25,"title":26,"published_at":27},"shinyhunters-claims-fbi-agent-data-theft-raising-counterintelligence-alarms","ShinyHunters Claims FBI Agent Data Theft, Raising Counterintelligence Alarms","2026-09-28T18:22:51.277+00:00",{"slug":29,"title":30,"published_at":31},"hse-fined-645k-after-physical-breaches-expose-psychiatric-medical-records","HSE Fined €645K After Physical Breaches Expose Psychiatric Medical Records","2026-09-03T10:21:11.155+00:00",{"slug":33,"title":34,"published_at":35},"fake-captcha-scam-deploys-macos-malware-to-drain-crypto-wallets","Fake CAPTCHA Scam Deploys macOS Malware to Drain Crypto Wallets","2026-08-06T14:20:56.389+00:00",{"slug":37,"title":38,"published_at":39},"insider-theft-of-seized-crypto-exposes-custody-control-failures","Insider Theft of Seized Crypto Exposes Custody Control Failures","2026-07-10T16:20:37.929+00:00",{"slug":41,"title":42,"published_at":43},"russian-hackers-target-signal-backup-keys-via-social-engineering","Russian Hackers Target Signal Backup Keys via Social Engineering","2026-06-26T20:20:43.516+00:00",{"slug":45,"title":46,"published_at":47},"japanese-energy-firm-loses-backup-drive-with-109-million-customer-records","Japanese Energy Firm Loses Backup Drive with 10.9 Million Customer Records","2026-06-12T00:20:28.583+00:00",[49,54,58,62,66,70],{"slug":50,"name":51,"problem":52,"stories":53},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",2,{"slug":55,"name":56,"problem":57,"stories":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":59,"name":60,"problem":61,"stories":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":63,"name":64,"problem":65,"stories":53},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":67,"name":68,"problem":69,"stories":53},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":71,"name":72,"problem":73,"stories":53},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[75,81,87,92,95,99,103,107],{"family":76,"item":77,"code":78,"title":79,"together":80},"gdpr","32","Article 32","Security of processing",6,{"family":82,"item":83,"code":84,"title":85,"together":86},"cis","3","Control 3","Data Protection",5,{"family":5,"item":88,"code":89,"title":90,"together":91},"ac-2","AC-2","Account Management",3,{"family":82,"item":93,"code":94,"title":90,"together":91},"5","Control 5",{"family":76,"item":96,"code":97,"title":98,"together":53},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":82,"item":100,"code":101,"title":102,"together":53},"14","Control 14","Security Awareness and Skills Training",{"family":82,"item":104,"code":105,"title":106,"together":53},"13","Control 13","Network Monitoring and Defense",{"family":82,"item":108,"code":109,"title":110,"together":53},"11","Control 11","Data Recovery"]