NIST 800-53 r5 · Controls catalogue · Family MP
MP-1Policy and Procedures
Develop, document, and disseminate to {{ insert: param, mp-1_prm_1 }}: {{ insert: param, mp-01_odp.03 }} media protection policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation of the media protection policy and the associated media protection controls; Designate an {{ insert: param, mp-01_odp.04 }} to manage the development, documentation, and dissemination of the media protection policy and procedures; and Review and update the current media protection: Policy {{ insert: param, mp-01_odp.05 }} and following {{ insert: param, mp-01_odp.06 }} ; and Procedures {{ insert: param, mp-01_odp.07 }} and following {{ insert: param, mp-01_odp.08 }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 5 mapping(s) from 2 framework(s): ASVS 5.0 3 (partial) · CSF 2.0 2 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | The media protection policy defines requirements and procedures to prevent unauthorized disclosure or access to sensitive information on media. |
CWE-284 | Improper Access Control | 5,367 | Policy and procedures establish documented access controls and responsibilities for media, reducing improper access. |
CWE-285 | Improper Authorization | 1,356 | Procedures enforce authorization rules for media handling, making unauthorized actions harder to perform without detection. |
CWE-319 | Cleartext Transmission of Sensitive Information | 1,076 | Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information. |
CWE-312 | Cleartext Storage of Sensitive Information | 935 | Policy requires protection measures such as encryption for sensitive data stored on media, preventing cleartext exposure. |
CWE-552 | Files or Directories Accessible to External Parties | 563 | Policy restricts media access to authorized parties only, preventing exposure of resources to external or unauthorized actors. |
CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | 32 | Procedures include sanitization, overwriting, and disposal requirements to remove sensitive data before media reuse or release. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||