{"data":{"id":"MP-05","name":"Media Transport","family":"MP","family_name":"Media Protection","withdrawn":false,"description":"a. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined controls];\nb. Maintain accountability for system media during transport outside of controlled areas;\nc. Document activities associated with the transport of system media; and\nd. Restrict the activities associated with the transport of system media to authorized personnel.","supplemental_guidance":"System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs. Non-digital media includes microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural controls to meet requirements established for protecting information and systems. Controls to protect media during transport include cryptography and locked containers. Cryptographic mechanisms can provide confidentiality and integrity protections depending on the mechanisms implemented. Activities associated with media transport include releasing media for transport, ensuring that media enters the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking and/or obtaining records of transport activities as the media moves through the transportation system to prevent and detect loss, destruction, or tampering. Organizations establish documentation requirements for activities associated with the transport of system media in accordance with organizational assessments of risk. Organizations maintain the flexibility to define record-keeping methods for the different types of media transport as part of a system of transport-related records.","enhancements":[{"id":"MP-05(01)","name":"Protection Outside of Controlled Areas","withdrawn":true,"incorporated_into":["MP-05"]},{"id":"MP-05(02)","name":"Documentation of Activities","withdrawn":true,"incorporated_into":["MP-05"]},{"id":"MP-05(03)","name":"Custodians","statement":"Employ an identified custodian during transport of system media outside of controlled areas.","baselines":[]},{"id":"MP-05(04)","name":"Cryptographic Protection","withdrawn":true,"incorporated_into":["SC-28(01)"]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"MP-05","name":"Media Transport","description":"a. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined controls];\nb. Maintain accountability for system media during transport outside of controlled areas;\nc. Document activities associated with the transport of system media; and\nd. Restrict the activities associated with the transport of system media to authorized personnel.","discussion":"System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state and magnetic), compact discs, and digital versatile discs. Non-digital media includes microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural controls to meet requirements established for protecting information and systems. Controls to protect media during transport include cryptography and locked containers. Cryptographic mechanisms can provide confidentiality and integrity protections depending on the mechanisms implemented. Activities associated with media transport include releasing media for transport, ensuring that media enters the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking and/or obtaining records of transport activities as the media moves through the transportation system to prevent and detect loss, destruction, or tampering. Organizations establish documentation requirements for activities associated with the transport of system media in accordance with organizational assessments of risk. Organizations maintain the flexibility to define record-keeping methods for the different types of media transport as part of a system of transport-related records.","related_controls":["AC-07","AC-19","CP-02","CP-09","MP-03","MP-04","PE-16","PL-02","SC-12","SC-13","SC-28","SC-34"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.5.10","A.7.9","A.7.10"],"iso_27002_2022":["5.14","7.9","7.10"],"cobit_2019":["APO14","BAI09"],"pci_dss_v4":["9.4"],"nist_csf_2":["PR.DS-01"],"cis_controls_v8":["CIS 3","CIS 3.9"],"soc2_tsc":[],"finos_ccc":["CCC-C16"],"iso_42001_2023":["A.4.3"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["11"],"pra_op_resilience":["SS2/21-11.1"],"bsi_grundschutz":[],"anssi":["Hygiene.19","SecNumCloud.9.2"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.C(63)","IV.D(78)","IV.D(81)"],"gdpr":["Art.5(1)(f)","Art.32(1)(a)","Art.44"],"dora":["Art.9(4)(a)","Art.9(4)(b)"],"bio2":["5.14","7.9","7.10"],"rbi_csf":["Annex1.12"],"fisc":["FISC.F4"],"lgpd_bcb":["BCB.Art.14","LGPD.Art.33-36"],"hkma_tme1":["TME1.6.5","TME1.7.2","TME1.9.2"],"mlps_2":["8.1.4.8","8.1.10.1"],"dnb_good_practice":[],"cra":["CRA.I.2e","CRA.I.2m"],"swift_cscf":["SWIFT.2.5A"],"cbb_tm":["TM-9"],"cbuae":["CR-5"],"nca_ecc":["2-6","2-7","2-9"],"qatar_nia":["AM"],"sama_csf":["3.9"],"uae_ia":["T4"],"bog_cisd":["CISD-V"],"cbe_csf":["CTO-2"],"cbn_csf":["Part3.4"],"sa_js2":["JS2-8.2"],"bcbs_239":["Principle 11"],"bot_cyber":["Ch2.3"],"ecb_croe":["CROE.2.3.3"],"ffiec_is":["II.C.13","II.C.13(c)","II.C.13(d)"],"hipaa_sr":["§164.308(a)(7)(ii)(A)","§164.310(d)(1)","§164.310(d)(2)(iii)"],"nydfs_500":["500.15"],"sebi_cscrf":["PR.DS"],"cmmc_2":["MP"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":["CBEST.9"],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["07.b","09.f"],"iso_27799":["12.3","13.2"],"lloyds_ms":["MS8.7"],"naic_ds":["4-encryption"],"nhs_dspt":["NDG-1.1"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":["DCS-02","DCS-04"],"csa_aicm":["DCS-02","DCS-04"],"ccss_v9":["1.01.4"],"mica":[],"basel_sco60":["SCO60.61","SCO60.63"],"bssc":["KMS-05","KMS-10"],"sec_custody_digital":["SEC-CD-06"],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.10 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-013"]}}