Information is disclosed due to mislabeled, unlabeled or mishandled physical or electronic media.
The organization:
a. Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and
b. Exempts [Assignment: organization-defined types of information system media] from marking as long as the media remain within [Assignment: organization-defined controlled areas].
Media is labeled for handling with detail as appropriate.
No statewide control
Obtain information system media protection policy; procedures addressing media labeling; physical and environmental protection policy and procedures; security plan; removable storage media and information system output; other relevant documents or records and ascertain if :
(I)the organization defines in the security plan, explicitly or by reference, its protected environment for media labeling requirements.
(ii)the organization defines in the security plan, explicitly or by reference, media types and hardware components that are exempted from external labeling requirements.
(iii)the organization affixes external labels to removable information storage media and information system output not otherwise exempted from this labeling requirement, indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.
