NIST 800-53 REV 5 • MEDIA PROTECTION
MP-5(3) — Custodians
Employ an identified custodian during transport of system media outside of controlled areas.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
Identified custodians provide organizations with specific points of contact during the media transport process and facilitate individual accountability. Custodial responsibilities can be transferred from one individual to another if an unambiguous custodian is identified.
Practitioner Notes
An identified custodian — a named, accountable person — must accompany media during transport outside controlled areas. The media should never be left unattended.
Example 1: Assign a specific employee as the custodian for each media shipment. The custodian is responsible for the media from the moment it leaves storage until it is delivered and receipt is confirmed. Document the custodian's name on the transport form.
Example 2: For courier-transported media, the courier company serves as custodian. Ensure your contract specifies chain-of-custody requirements and that the courier provides signed delivery receipts. Retain these receipts in your compliance files for at least the retention period specified in your policy.