# MP-02 Media Access

NIST SP 800-53 control. Family: MP Media Protection. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
Guidance: System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Denying access to patient medical records in a community hospital unless the individuals seeking access to such records are authorized healthcare providers is an example of restricting access to non-digital media. Limiting access to the design specifications stored on compact discs in the media library to individuals on the system development team is an example of restricting access to digital media.

## Enhancements (none current)
Withdrawn by NIST: MP-02(01) (now in MP-04(02)); MP-02(02) (now in SC-28(01)).

## Patterns that use it (5)
- Important (2): SP-013 Data Security Pattern; SP-015 Secure Remote Working
- Standard (3): SP-001 Client Module; SP-002 Server Module; SP-029 Zero Trust Architecture

## Clauses by framework (54 frameworks)
- iso_27001_2022: A.5.10, A.7.7, A.7.10
- iso_27002_2022: 7.10
- cobit_2019: APO14, BAI09
- pci_dss_v4: 9.4
- cis_controls_v8: CIS 3
- soc2_tsc: C1.1
- finos_ccc: CCC-C16
- iso_42001_2023: A.4.3
- mas_trm: 11
- anssi: Hygiene.14, Hygiene.19, SecNumCloud.9.2
- osfi_b13: B-13.3.2
- finma_circular: IV.B.d(59), IV.D(78), IV.D(80)
- gdpr: Art.5(1)(f), Art.32(1)(b)
- dora: Art.9(4)(b)
- bio2: 7.10
- rbi_csf: Annex1.12
- fisc: FISC.F4, FISC.T5
- lgpd_bcb: LGPD.Art.46
- hkma_tme1: TME1.7.2
- mlps_2: 8.1.10.1
- dnb_good_practice: DNB.12.1
- swift_cscf: SWIFT.3.1
- cbb_tm: TM-9
- cbuae: CR-5
- nca_ecc: 2-7
- qatar_nia: AM
- sama_csf: 3.9
- uae_ia: T4
- bog_cisd: CISD-V
- cbe_csf: CTO-2
- cbn_csf: Part3.4
- popia: s19
- sa_js2: JS2-6.1, JS2-8.2
- bcbs_239: Principle 11
- bot_cyber: Ch2.3
- cpmi_pfmi: CG.PR
- ecb_croe: CROE.2.2.2, CROE.2.3.3
- ffiec_is: II.C.13, II.C.13(a)
- hipaa_sr: §164.310(c), §164.310(d)(1)
- sebi_cscrf: PR.DS
- cmmc_2: MP
- nerc_cip: CIP-011-3
- nrc_73_54: RG5.71-B-MA
- api_1164: Sec 8
- fda_cyber: SA-4
- hitrust_csf: 07.b, 09.f
- lloyds_ms: MS8.7
- naic_ds: 4B
- nhs_dspt: NDG-1.1
- solvency_ii: DR.266-DataSec
- csa_ccm_v4: HRS-03
- csa_aicm: HRS-03
- mica: Art.40(1), Art.55(1), Art.63(1), Art.97(1)
- basel_sco60: SCO60.61
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/MP-02
- Clauses only: /api/v1/controls/MP-02?fields=mappings
- Page for people: /controls/mp-02/