Information Security Handbook

Media protection policy

The media protection policy is responsible for defining how media will be handled within the organization. This includes secure handling, what media is allowed, how media should be protected, and how media should be destroyed.

What the media protection policy should address:

• Protecting information system media, both paper and digital
• Limiting access to information on information system media to authorized users
• Sanitizing or destroying information system media before disposal or release for reuse
• Marking media with necessary markings and distribution limitations
• Controlling access to media and maintaining accountability for media during transport outside of controlled areas
• Implementing cryptographic mechanisms to ...