MP-4(2)

Requirement

Restrict access to media storage areas and log access attempts and access granted using [Assignment: organization-defined automated mechanisms].

Discussion

Automated mechanisms include keypads, biometric readers, or card readers on the external entries to media storage areas.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System media protection policy; procedures addressing media storage; access control policy and procedures; physical and environmental protection policy and procedures; system design documentation; system configuration settings and associated documentation; media storage facilities; access control devices; access control records; audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system media protection and storage responsibilities; organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Automated mechanisms restricting access to media storage areas; automated mechanisms auditing access attempts and access granted to media storage areas].

ID	Assessment Objectives
MP-04(02)[01]	access to media storage areas is restricted using <MP-04(02)_ODP[01] automated mechanisms>;
MP-04(02)[02]	access attempts to media storage areas are logged using <MP-04(02)_ODP[02] automated mechanisms>;
MP-04(02)[03]	access granted to media storage areas is logged using <MP-04(02)_ODP[03] automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!