# MP-06 Media Sanitization

NIST SP 800-53 control. Family: MP Media Protection. Function: preventative. Baselines: low, moderate, high, privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Sanitize [Assignment: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures]; and b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Guidance: Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.

## Enhancements (5)
- MP-06(01) Review, Approve, Track, Document, and Verify. Baselines: high
- MP-06(02) Equipment Testing. Baselines: high
- MP-06(03) Nondestructive Techniques. Baselines: high
- MP-06(07) Dual Authorization
- MP-06(08) Remote Purging or Wiping of Information
Withdrawn by NIST: MP-06(04) (now in MP-06); MP-06(05) (now in MP-06); MP-06(06) (now in MP-06).
Each enhancement's statement: /api/v1/controls/MP-06?fields=enhancements

## Patterns that use it (4)
- Important (2): SP-013 Data Security Pattern; SP-026 PCI Full Environment
- Standard (2): SP-015 Secure Remote Working; SP-050 Mobile Security Architecture (draft)

## Clauses by framework (65 frameworks)
- iso_27001_2022: A.5.10, A.7.10, A.7.14, A.8.10
- iso_27002_2022: 7.10, 7.14, 8.10
- cobit_2019: APO14, BAI09
- pci_dss_v4: 9.4
- nist_csf_2: GV.SC-10, ID.AM-08. OSA's own, not in NIST's crosswalk: GV.SC-10, ID.AM-08
- cis_controls_v8: CIS 3, CIS 3.5, CIS 4.11, CIS 15.7
- soc2_tsc: CC6.5
- finos_ccc: CCC-C16
- iso_42001_2023: A.4.3
- mas_trm: 11
- bsi_grundschutz: CON.6
- anssi: Hygiene.19, SecNumCloud.9.3
- osfi_b13: B-13.3.2
- finma_circular: IV.D(78), IV.E(83), IV.E(84)
- gdpr: Art.5(1)(f), Art.17(1), Art.32(1)(a)
- dora: Art.9(4)(b)
- bio2: 7.10, 7.14, 8.10
- rbi_csf: Annex1.12
- fisc: FISC.F4, FISC.O9
- lgpd_bcb: LGPD.Art.15-16
- hkma_tme1: TME1.7.2
- mlps_2: 8.1.4.10, 8.1.10.1
- dnb_good_practice: DNB.12.2
- cra: CRA.I.2m, CRA.Info.8d
- cbb_tm: TM-9
- cbuae: CR-5
- nca_ecc: 2-7
- qatar_nia: AM
- sama_csf: 3.9
- uae_ia: T4
- bog_cisd: CISD-V
- cbe_csf: CTO-2
- cbn_csf: Part3.4
- popia: s14, s19
- sa_js2: JS2-8.2
- bot_cyber: Ch2.3
- cpmi_pfmi: CG.PR
- ecb_croe: CROE.2.3.3
- ffiec_is: II.C.13, II.C.13(c)
- hipaa_sr: §164.310(d)(1), §164.310(d)(2)(i), §164.310(d)(2)(ii)
- nydfs_500: 500.13
- sebi_cscrf: PR.DS
- cmmc_2: MP
- nerc_cip: CIP-011-3
- nrc_73_54: RG5.71-B-MA
- pci_pts: K
- fips_140: FIPS 140-3 §7.9
- cbest: CBEST.9
- tiber_eu: TIBER.CONF
- pci_hsm: 5
- common_criteria: CC Part 2 — FDP
- fda_cyber: SA-4
- hitrust_csf: 06.b, 09.f
- lloyds_ms: MS8.7
- naic_ds: 4-asset, 4B
- pra_ss1_23: P5.5
- solvency_ii: DR.266-DataSec
- owasp_masvs_v2: MASVS-STORAGE-1
- csa_ccm_v4: CEK-14, DCS-01, DSP-02, DSP-16, UEM-13
- csa_aicm: CEK-14, DCS-01, DSP-02, DSP-16, UEM-13
- ccss_v9: 2.02.1, 2.02.2, 2.02.3
- mica: Art.62(9)
- basel_sco60: SCO60.63
- bssc: GSP-09
- dpdpa: Act.8(7), Rules.8(1)
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/MP-06
- Clauses only: /api/v1/controls/MP-06?fields=mappings
- Page for people: /controls/mp-06/