Task 2 RMF_Media Protection Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Media Protection Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F, "Information Assurance (IA) and Support to Computer Network Defense (CND)"

ii. DODM NUMBER 5200.01, Volume 1, "DoD Information Security Program: Overview, Classification, and Declassification"

iii. DODM NUMBER 5200.01, Volume 2, "DoD Information Security Program: Marking of Classified Information"

iv. DODM NUMBER 5200.01, Volume 3, "DoD Information Security Program: Protection of Classified Information"

v. DODM NUMBER 5200.01, Volume 4, "DoD Information Security Program: Controlled Unclassified Information (CUI)"

vi. DOD CIO Memorandum, 3 July 2007, “Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media”

vii. NIST Special Publication 800-88 R1, "Guidelines for Media Sanitization"

viii. CTO 08-001, "JTF-GNO Communications Tasking Order (CTO) 08-001, Encryption of Sensitive Unclassified Data at Rest (DAR) on Mobile Computing Devices and Removable Storage Media Used Within the Department of Defense (DoD)"

ix. CTO 08-001 (Attachment), "JTF-GNO Communications Tasking Order (CTO) 08-001, Encryption of Sensitive Unclassified Data at Rest (DAR) on Mobile Computing Devices and Removable Storage Media Used Within the Department of Defense (DoD) (Attachment)"

x. CTO 10-133, "USCYBERCOM Communications Tasking Order (CTO) 10-133 Protection of Classified Information on Department of Defense Secret Internet Protocol Router Network (SIPRNet)"

xi. CTO 10-133A, "Communications Tasking Order (CTO) 10-133 10-133A, Amplifying Guidance"

xii. National Security Agency (NSA) Media Destruction Guidance

Table of Contents

Figure 1 - Sanitization and Disposition Decision Flow 5

FOR OFFICIAL USE ONLY

{ACRONYM}

MEDIA PROTECTION PLAN {DATE}

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The information security concerns regarding media protection resides not in the media itself, but in the recorded information. The issue of media protection is driven by the information placed intentionally or unintentionally on the media. Electronic media used on a system should be assumed to contain information commensurate with the security categorization of the system’s confidentiality. If not handled properly, release of these media could lead to an occurrence of unauthorized disclosure of information.

This plan does not claim to cover all possible media that {ACRONYM} could use to store information, nor does it attempt to forecast the future media that may be developed during the effective life of this plan. Users are expected to make protection decisions based on the security categorization of the information contained on the media and the overarching regulations that govern media disposal, sanitization and control listed in the Amplifying Guidance section of this document.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix I, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

1.1 Applicability

This Media Protection Plan applies to {ACRONYM} and its components.

1.2 Roles and Responsibilities

The following roles have been established for the {ACRONYM} in accordance DoD 5200.01-M, CTO 10-133, and CTO 08-001 to restrict access to media:

{PHONE}

{EMAIL}

{PHONE}

{EMAIL}

{PHONE}

{EMAIL}

Table 2 - Roles and Responsibilities

Classified Media – all classified media shall be secured under conditions adequate to deter and detect access by unauthorized persons. Holdings of classified media will be reduced to the minimum required to accomplish the mission. GSA establishes and publishes minimum standards, specifications, and supply schedules for containers, vault doors, modular vaults, alarm systems, and associated security devices suitable for storing and protecting classified information. DoDI 3224.03 describes requirements for acquiring physical security equipment for use within the Department of Defense. Refer to DODM NUMBER 5200.01, Volume 3, "DoD Information Security Program: Protection of Classified Information" for specific guidance.

For Official Use Only Media – During working hours, reasonable steps shall be taken to minimize the risk of access by unauthorized personnel (e.g., not reading, discussing, or leaving FOUO information unattended where unauthorized personnel are present). After working hours, FOUO information may be stored in unlocked containers, desks, or cabinets if Government or Government-contract building security is provided. If such building security is not provided or is deemed inadequate, the information shall be stored in locked desks, file cabinets, bookcases, locked rooms, etc. Refer to refer to DODM NUMBER 5200.01, Volume 4, "DoD Information Security Program: Controlled Unclassified Information (CUI)" for specific guidance.

2.2 Protection During Transport

FIPS 140-2 or other NSA approved cryptographic mechanisms will be used to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

Appropriately cleared and briefed personnel may be authorized to escort or carry classified material between locations when other means of transmission or transportation cannot be used. The Heads of the DoD Components shall establish procedures to ensure that hand-carrying of classified material is minimized to the greatest extent possible and does not pose unacceptable risk to the information. Hand carrying may be authorized only when:

1) The information is not available at the destination and operational necessity or a contractual requirement requires it.

2) The information cannot be sent via a secure e-mail, facsimile transmission or other secure means.

3) The appropriate official authorizes the hand-carry according to procedures the Head of the DoD Component establishes.

4) The hand-carry is accomplished aboard a U.S. carrier, or a foreign carrier if no U.S. carrier is available, and the U.S. escort retains custody and physical control of the information at all times.

5) Arrangements have been made for secure storage of the information at a U.S. Government or cleared U.S. contractor facility.

Refer to DODM NUMBER 5200.01, Volume 3, "DoD Information Security Program: Protection of Classified Information" for specific guidance.

All classified information shall be identified clearly by marking, designation, or electronic labeling. If physical marking of the medium containing classified information is not possible, then identification must be accomplished by other means. The term “marking” includes other concepts of identifying the classification of the information. Markings, designations, and electronic labeling shall be conspicuous and immediately apparent and shall:

a) Alert holders to the presence of classified information.

b) Identify, as specifically as possible, the exact information needing protection and the level of protection required.

c) Give information on the source(s) of and reasons for classification of the information.

d) Identify the office of origin and document originator applying the classification markings.

e) Provide guidance on information sharing, and warn holders of special access, dissemination control, or safeguarding requirements.

f) Provide guidance on downgrading and declassification for classified information.

The proper marking of a classified document is the specific responsibility of the original or derivative classifier (i.e., the author or originator of the information). Derivative classifiers shall refer to the source document(s), security classification guide(s), or other guidance issued by the original classification authority (OCA) when determining the markings to apply.

Refer to DODM NUMBER 5200.01, Volume 2, "DoD Information Security Program: Marking of Classified Information" for specific guidance.

3.2 Removable Media

Removable storage media used with computers, IT systems, and other electronic devices will be conspicuously marked. (Examples of such media include, but are not limited to, compact discs, DVDs, removable hard disks, flash or “thumb” drives, magnetic tape reels, disk packs, floppy disks and diskettes, disk cartridges, optical discs, paper tape, magnetic cards, memory chips, and tape cassettes and micro-cassettes.) Internal media identification will include security markings in a form suitable for the media. All such devices bearing classified information must be conspicuously marked with the highest level of classification of information stored on the device and any dissemination control notices that apply to the information.

For classified information, refer to DODM NUMBER 5200.01, Volume 2, "DoD Information Security Program: Marking of Classified Information" for specific guidance.

For Controlled Unclassified Information, refer to DODM NUMBER 5200.01, Volume 4, "DoD Information Security Program: Controlled Unclassified Information (CUI)" for specific guidance.

4.0 SANITIZATION

In accordance with CCI-001028, DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88. Sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort. This plan will assist {ACRONYM} and system owners in making practical sanitization decisions based on the categorization of confidentiality of their information. It does not, and cannot, specifically address all known types of media; however, the described sanitization decision process can be applied universally. The categories of sanitization are defined as follows:

1) Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; typically applied through the standard Read and Write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state (where rewriting is not supported).

2) Purge applies physical or logical techniques that render Target Data recovery infeasible using state of the art laboratory techniques.

3) Destroy renders Target Data recovery infeasible using state of the art laboratory techniques and results in the subsequent inability to use the media for storage of data It is suggested that the {ACRONYM} categorize the information, assess the nature of the medium on which it is recorded, assess the risk to confidentiality, and determine the future plans for the media. Then, the {ACRONYM} can choose the appropriate type(s) of sanitization. {ACRONYM} will use the following process to assist them in making sanitization decisions that are commensurate with the security categorization of the confidentiality of information contained on the media. The decision process is based on the confidentiality of the information, not the type of media. Once {ACRONYM} decides what type of sanitization is best for their individual case, then the media type will influence the technique used to achieve this sanitization goal.

Figure 1 - Sanitization and Disposition Decision Flow Validating the selected information sanitization and disposal process is an essential step in maintaining confidentiality. Two types of verification should be considered. The first is verification every time sanitization is applied (where applicable, as most Destroy techniques do not support practical verification for each sanitized piece of media). The second is a representative sampling verification, applied to a selected subset of the media. If possible, the sampling should be executed by personnel who were not part of the original sanitization action.

Following sanitization, a certificate of media disposition will be completed for each piece of electronic media that has been sanitized. An example sanitization certificate is contained within Enclosure 1, “Sanitization Certificate”. NIST SP 800-88 Rev. 1, Appendix A contains detailed Minimum Sanitization Recommendations.

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Number

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as all users.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 5 years reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoDI 5200.01 and DoDM 5200.01 Vol. 1-4 meet the DoD requirements for media protection policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.01 and DoDM 5200.01 Vol. 1-4.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization conducting the inspection/assessment interviews organizational personnel with information system media protection responsibilities to ensure the organization being inspected/assessed restricts access to all types of digital and/or non-digital media containing information not cleared for public release to the personnel or roles defined in MP-2, CCI 1005.

DoD has defined the types of digital and non-digital media as all types of digital and/or non-digital media containing information not cleared for public release.

Section 1.2

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to restrict access to media to ensure the access is granted IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level, but personnel must be identified IAW DoD 5200.01-M, CTO 10-133, and CTO 08-001.

Section 1.2

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the types of digital and non-digital media as all types of digital and/or non-digital media containing information not cleared for public release.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the list of information system media as nothing unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4 Automatically compliant with this CCI because they are covered at the DoD level

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the controlled areas as all areas unless otherwise exempted by DoDI 5200.01 and DoDM 5200.01 Vol 1-4 Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate

The organization conducting the inspection/assessment obtains and examines the list of all digital and non-digital media containing sensitive, controlled, and/or classified information within areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media to ensure that physical controls are in place and that it is securely stored as defined in PE-3.

DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.

DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.

Section 2.1

Moderate High Moderate

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the digital and non-digital media types as all digital and non-digital media containing sensitive, controlled, and/or classified information.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the controlled areas as areas approved for processing or storing data IAW the sensitivity and/or classification level of the information contained on/within the media.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate

Enclosure 2

Moderate High Moderate

Moderate High Moderate

Moderate High Moderate

DoD has defined the types of information system media as all digital and non-digital media containing sensitive, controlled, and/or classified information.

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate

DoD has defined the security safeguards as DoDI 5200.1R and other organizationally defined security safeguards.

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate High Moderate

Moderate High Moderate

Moderate High Moderate

The organization conducting the inspection/assessment obtains and examines the list of personnel authorized to transport information system media outside of controlled areas.

Organizational personnel with information system media transport responsibilities and security management personnel are to be interviewed. The purpose of the reviews and reviews is to determine if the organization has established restrictions associated with the transport of information system media to authorized personnel only.

Section 2.2

The organization conducting the inspection/assessment obtains and examines documented test plans and evidence of past tests to ensure that tests are conducted every 180 days to verify correct performance of sanitization equipment and procedures.

DoD has defined the frequency as every 180 days.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 180 days.

Automatically compliant with this CCI because they are covered at the DoD level

The organization conducting the inspection/assessment obtains and examines media sanitization records, audit records, and any other relevant documents or records.

The objective of the reviews is to confirm the organization is in compliance with the list of defined circumstances requiring the sanitization of portable storage devices prior to connecting such devices to the information system.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the circumstances as when such devices are first purchased from the manufacturer or vendor prior to initial use, when being considered for reuse, or when the organization loses a positive chain of custody for the device. Media obtained from unknown sources shall not be sanitized and reused.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the information system media is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the information systems, system components, or devices are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the conditions are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Low

The organization conducting the inspection/assessment obtains and examines media sanitization records, audit records, any other relevant documents or records, and sanitization tools to ensure sanitization is in compliance with DoDM 5200.01 Vol. 1-4 and uses techniques and procedures IAW NIST SP 800-88.

The objective of the review is to verify the organization is sanitizing its digital and non-digital information system media prior to disposal, release for reuse, or release out of the organizational control.

DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.

DoD has defined the information system media as all media.

Section 4 Enclosure 1

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the information system media as all media.

Automatically compliant with this CCI because they are covered at the DoD level

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the sanitization techniques as techniques and procedures IAW NIST SP 800-88.

Automatically compliant with this CCI because they are covered at the DoD level

Enclosure 1

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented type of information system media to ensure the organization being inspected/assessed defines the types of information system media to restrict or prohibit on organization-defined information systems or system components using organization-defined security safeguards.

DoD has determined the types of information system media are not appropriate to define at the Enterprise level.

Section 4 Enclosure 1

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented information systems or system components to ensure the organization being inspected/assessed defines the information systems or system components to restrict or prohibit the use of organization-defined types of information system media using organization-defined security safeguards.

DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.

Section 4 Enclosure 1

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines the security safeguards to use for restricting or prohibiting the use of organization-defined types of information system media on organization-defined information systems or system components.

DoD has determined the security safeguards are not appropriate to define at the Enterprise level.

Section 4 Enclosure 1

Moderate Low High Moderate Low

High Moderate Low

DoD has defined the frequency as at a minimum annually.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the frequency as at a minimum annually.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the tests are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the frequency as at a minimum annually.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the Controlled Unclassified Information (CUI) as any Controlled Unclassified Information (CUI).

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the information system media downgrading process is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the strength and integrity are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the information system media is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

ENCLOSURE 1 – SANITIZATION CERTIFICATE

CERTIFICATE OF SANITIZATION

PERSON PERFORMING SANITIZATION

MEDIA INFORMATION

Serial Number: Enter text.

Media Property Number: Enter text.

Backup Location: Enter text.

SANITIZATION DETAILS

Method Details: Enter text.

Tool Used (include version): Enter text.

Post Sanitization Classification: Enter text.

Notes: Enter text.

MEDIA DESTINATION

Details: Enter text.

SIGNATURE

I attest that the information provided on this statement is accurate to the best of my knowledge

VALIDATION

Signature:

Date: Enter a date.

ENCLOSURE 2 – REMOVABLE MEDIA INVENTORY

FOR OFFICIAL USE ONLY 17

The following table contains the inventory of {ACRONYM} removable storage devices and their compliance status with the Removable Storage and External Connections Security Technical Implementation Guide (STIG).

STO-ALL-010

IA Approved

STO-ALL-030

Device ID

Gov. Owned

STO-DRV-010

Password/PIN

STO-DRV-021

NSA Approved

STO-DRV-025

DAR Enforced

STO-DRV-040

Signed Firmware image2.png image3.png image4.jpeg image1.gif