Media Accountability

Define your controlled areas before you argue about transport.

Objective [b] only applies outside of controlled areas, so the boundary has to exist on paper first. Say in your system security plan, the document that describes how your system meets each requirement, which rooms, floors, or buildings are controlled and by what mechanism. Inside that line, MP.L2-3.8.1 and MP.L2-3.8.2 govern. The moment media crosses it, [b] wants a record of who has the media and where it is going.

Accountability is a record, and a transport log is the simplest one.

The log records who took which item, when, to where, and when it came back. A sign-out sheet next to the media cabinet or a ticket in your help desk system both work. The guide's accountability language is about restricting transport to authorized people and keeping explicit records of the movement, which is a log by any name.

Encrypt what travels, and the loss becomes an inconvenience instead of an incident.

The guide names locked containers and cryptography as the transport controls. FIPS validation is the federal program that certifies encryption modules. A FIPS-validated encrypted drive that goes missing in a taxi is a recoverable event. Encryption does not replace the accountability record, but it is the control that matters most when the record says the media is gone.

Shipped media gets packaging, a named recipient, and a tracking number.

The assessment guide's example is exactly this: tamper-evident packaging, a specific addressee, a reputable carrier, and the tracking number shared with the recipient. That paper trail is [b] for anything you cannot hand-carry.

Hand-carried media stays in your personal possession.

A drive or a tube of drawings you carry is under direct control only while it is actually with you. Do not check it as luggage. Do not leave it in a car. Log it out and back in like any other transport.