MP-8

MP-8 MEDIA DOWNGRADING

Overview

Number	Title	Impact	Priority	Subject Area
MP-8	Media Downgrading		P0	Media Protection

Instructions
The organization: MP-8a. Establishes Assignment: organization-defined information system media downgrading process that includes employing downgrading mechanisms with Assignment: organization-defined strength and integrity; MP-8b. Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information; MP-8c. Identifies Assignment: organization-defined information system media requiring downgrading; and MP-8d. Downgrades the identified information system media using the established process.

Instructions

The organization:

MP-8a.

Establishes Assignment: organization-defined information system media downgrading process that includes employing downgrading mechanisms with Assignment: organization-defined strength and integrity;

MP-8b.

Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;

MP-8c.

Identifies Assignment: organization-defined information system media requiring downgrading; and

MP-8d.

Downgrades the identified information system media using the established process.

Guidance
This control applies to all information system media, digital and non-digital, subject to release outside of the organization, whether or not the media is considered removable. The downgrading process, when applied to system media, removes information from the media, typically by security category or classification level, such that the information cannot be retrieved or reconstructed. Downgrading of media includes redacting information to enable wider release and distribution. Downgrading of media also ensures that empty space on the media (e.g., slack space within files) is devoid of information.

Guidance

This control applies to all information system media, digital and non-digital, subject to release outside of the organization, whether or not the media is considered removable. The downgrading process, when applied to system media, removes information from the media, typically by security category or classification level, such that the information cannot be retrieved or reconstructed. Downgrading of media includes redacting information to enable wider release and distribution. Downgrading of media also ensures that empty space on the media (e.g., slack space within files) is devoid of information.

Enhancements

MP-8 (1) Documentation Of Process

Organizations can document the media downgrading process by providing information such as the downgrading technique employed, the identification number of the downgraded media, and the identity of the individual that authorized and/or performed the downgrading action.

The organization documents information system media downgrading actions.

MP-8 (2) Equipment Testing

The organization employs Assignment: organization-defined tests of downgrading equipment and procedures to verify correct performance Assignment: organization-defined frequency.

MP-8 (3) Controlled Unclassified Information

The organization downgrades information system media containing Assignment: organization-defined Controlled Unclassified Information (CUI) prior to public release in accordance with applicable federal and organizational standards and policies.

MP-8 (4) Classified Information

Downgrading of classified information uses approved sanitization tools, techniques, and procedures to transfer information confirmed to be unclassified from classified information systems to unclassified media.

The organization downgrades information system media containing classified information prior to release to individuals without required access authorizations in accordance with NSA standards and policies.