| Control ID |
Control Description | Data Protection Classification | ||||||
| Level 1 | Level 2 | Level 3 | Level 4 | |||||
| MP-1 | Protect (i.e., physically control and securely store) system media containing data, both paper and digital. | optional | recommended | essential | essential | |||
| MP-2 | Limit access to the University’s data on system media to authorized users. | optional | recommended | essential | essential | |||
| MP-3 | Sanitize or destroy system media containing the University’s data before disposal or release for reuse. | optional | recommended | essential | essential | |||
| MP-5 | Control access to media containing the University’s data and maintain accountability for media during transport outside of controlled areas. | optional | recommended | essential | essential | |||
| MP-6 | Implement cryptographic mechanisms to protect the confidentiality of the University’s data stored on digital media during transport unless otherwise protected by alternative physical safeguards. | optional | recommended | essential | essential | |||
| MP-9 | Protect the confidentiality of backup University data at storage locations. | optional | recommended | essential | essential | |||