MP-01 - Media Protection Policy and Procedures

Introduction

This document describes how Private Mendix Platform fulfills the MP-01 control.

Control

The organization:

• Develops, documents, and disseminates to organization-defined personnel or roles:

  • A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
  • Procedures to facilitate the implementation of the media protection policy and associated media protection controls.

• At an organization-defined frequency, reviews and updates the current:

  • Media protection policy
  • Media protection procedures.

Supplemental Guidance

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the Media Protection (MP) family.

Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary.

The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.

The following controls are related to this control:

• PM-9

For more information, refer to the NIST Special Publications 800-12 and 800-100.

Responsibility

Customer Responsibility

The customer is responsible for developing a media protection policy, documenting it, and ensuring its implementation across the infrastructure, Private Mendix Platform, and various Mendix apps.

The App and Infra Implementers and Operators are responsible for ensuring the Mendix solution adheres to this customer-defined policy throughout its lifecycle.

Guidance

Customer Responsibility

This is not a Mendix responsibility. It is the responsibility of the customer to develop a media protection policy and procedures.

It is the responsibility of the Infra Implementer to ensure the infrastructure and Private Mendix Platform are implemented in a way that is in compliance with, and support of, the customer's media protection policy.

It is the responsibility of the App Implementer to ensure that the Mendix app is implemented in a way that is in compliance with, and supporting of, the customer's media protection policy.

It is the responsibility of the Infra Operator and App Operator to ensure ongoing compliance of the Mendix solution throughout its lifecycle.