Information resource owners are responsible for controlling access to, and maintaining appropriate handling and storage procedures for, storage media entrusted to their care.
Data stored on removable computer media is damaged or disclosed due to ineffective handling procedures.
The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
Users are limited access to media based on roles and/or responsibilities.
The state organization restricts access to information system media to authorized individuals.
Obtain Information system media protection policy; procedures addressing media access; access control policy and procedures; physical and environmental protection policy and procedures; media storage facilities; access control records; access control records; audit records; other relevant documents or records and ascertain if :
(I)the organization restricts access to information system media to authorized users.
(ii)the organization employs automated mechanisms to restrict access to media storage areas.
(iii)the organization employs automated mechanisms to audit access attempts and access granted.
