Question 1

What evidence do auditors ask for on MP-8 Media Downgrading. Establish [organization-defined] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information; Verify that the system media downgrading process is commensurate with the?

Accepted Answer

The defined media downgrading process, including the mechanisms used and their assessed strength; Categorisation documentation establishing the security category or classification the downgrade must be commensurate with; List of media requiring downgrading and the disposition of each; Verification records showing the downgrading process was tested and the information is not recoverable; Records of each downgrade performed, including operator, method and date.

Question 2

Can MP-8 be evidenced continuously rather than by periodic review?

Accepted Answer

Mostly documents and reviews. Pull the 1 system-held artefact from your Data governance / DLP tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Question 3

What is the most common gap auditors find on MP-8?

Accepted Answer

Downgrading method chosen for convenience without assessing its strength against the classification

`MP-8` Media Downgrading. Establish [organization-defined] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information; Verify that the system media downgrading process is commensurate with the

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet