Media Protection

Media Protection

Authorized By: Chief Information Security Officer (CISO)

Purpose

This document establishes the Media Protection Policy for Safire, Inc. It defines information security requirements to ensure device and media protection during storage, transport, sanitization, and disposal across their complete lifecycle.

Media protection is essential to prevent unauthorized disclosure of sensitive information, maintain data integrity, and ensure compliance with regulatory requirements, including CMMC, NIST SP 800-171, and other applicable standards.

Scope

This Policy applies to all employees, contractors, temporary employees, volunteers, and third parties of Safire who handle, access, transport, store, or dispose of organizational media. It includes appropriate processes to protect data in any medium (e.g., paper, portable devices, cloud storage, etc.) based on the data’s classification.

Policy

1. Media Access Safire shall restrict access to digital and non-digital media to authorized individuals.
2. Digital media includes, but is not limited to, external hard drives, flash drives, and optical disks.
3. Non-digital media includes, but is not limited to, paper and microfilm.
4. Media Marking To safeguard information, Safire shall ensure media is marked with appropriate classification labels and handling caveats.
5. Media containing Public data requires no marking.
6. Media containing Restricted or Confidential data must be labeled in accordance with the Safire Data Protection Policy (e.g., For Official Use Only , Restricted Information ).
7. Internal Use: When media remains within a secure, company-controlled enclave, physical marking is recommended but optional, provided digital safeguards are in place.
8. Media Storage Safire shall implement physical and logical controls to ensure the secure storage of digital and non-digital media. All users must:
9. Classify and label media to identify sensitivity.
10. Store sensitive media in locked containers or secured areas when not in use.
11. Ensure that access to storage areas is limited to authorized personnel.
12. Media Sanitization and Disposal All equipment used to store, process, or transmit Controlled Unclassified Information (CUI) or sensitive company data must be sanitized prior to disposal or release for off-site maintenance.
13. Process: The IT Department must identify and verify equipment requiring sanitization.
14. Approved Methods: Sanitization must be performed using one of the following methods:

• Clear: Overwriting data (Erasing/Wiping).
• Purge: Degaussing (for magnetic media).
• Destroy: Physical destruction (Shredding, Disintegrating, Incinerating).

5. Media Transport When transporting media outside of Safire controlled areas, users must strictly adhere to the following controls:

• Encryption: Sensitive information on digital media must be encrypted during transport.
• Physical Security: Sensitive hard copy information must be enclosed in opaque, sealed envelopes or locked containers.
• Accountability: Transport activities must be restricted to authorized personnel or bonded couriers (e.g., commercial delivery services with tracking).
• Documentation: Safire shall maintain records of transport activities to prevent loss, destruction, or tampering.

6. Media Use Safire shall implement physical and logical security controls to protect the confidentiality and integrity of information system storage media throughout its lifecycle. This includes the prohibition of unauthorized portable storage devices on Safire networks.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exception

Any exceptions must be approved by the Policy Owner in advance and formally documented.

Date	Authorized By	Exception Description

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Data Classification Policy
• Data Protection Policy

Revision History: Revision History

Date	Name	Revision Description

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page