Frameworks / NIST SP 800-88 / NISTSP88-1 NIST SP 800-88
Policy, Roles, Decision Framework
NIST SP 800-88 NISTSP88-1: Media Sanitization Policy, Roles, and Decision Framework Establish media sanitization policy per NIST SP 800-88 Rev 1 Chapter 4 (Information Sanitization and Disposition Decision Flow). Policy must (a) define the scope of media covered (electronic storage media + paper + microform + cloud-resident data + ephemeral storage), (b) name accountable roles per Chapter 3 (Information Sanitization and Decisionmaking Process): Information Owner + System Owner + Information System Security Officer + Property Custodian + Media Sanitization Personnel + Security Officer + Security Compliance Officer + Records Officer + General Counsel, (c) establish the sanitization decision flow per Section 4.5 considering Security Categorization (Confidential / Moderate / High per FIPS 199) + intended disposition (re-use within control / re-use leaving control / not re-used) + media type characteristics, (d) define sanitization method categories (Clear + Purge + Destroy) per Section 2.5 with mappings to media types, (e) integrate with property disposal + records retention + IT lifecycle + sustainability programs. Policy must specify minimum sanitization method per security category per disposition path with documented justification for any deviation. Review and update policy annually and on regulatory or technological change.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 350 controls across 126 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ISO27043-04 Roles and responsibilities definition ISO27043-06 Asset inventory and ownership ISO27043-08 Information classification and labeling ISO27043-10 Media management and disposal ISO27043-11 Access control policy and enforcement ISO27043-12 User access management and provisioning ISO27043-13 Authentication and password management ISO27043-14 Privileged access management ISO27043-15 Access review and recertification ISO21434-04 Roles and responsibilities definition ISO21434-07 Acceptable use of assets ISO21434-08 Information classification and labeling ISO21434-09 Asset handling procedures ISO21434-12 User access management and provisioning ISO21434-13 Authentication and password management ISO21434-14 Privileged access management ISO21434-15 Access review and recertification AWWA-1.1 Security Policy and Governance AWWA-1.3 Security Awareness and Training AWWA-2.1 User Access Management AWWA-2.2 Authentication Mechanisms AWWA-2.3 Account Management AWWA-2.4 Physical Access Controls BSI-01 Account management and provisioning BSI-02 Access enforcement and least privilege BSI-03 Multi-factor authentication requirements BSI-04 Remote access controls BSI-05 Wireless access restrictions BSI-15 Security categorization ISO-19650-1-4 Information management concepts ISO-19650-1-5 Delivery team and task team concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-2-5.7 Information model delivery ISO-19650-3-5.3 Trigger events for information exchange ISMSP-AC-01 Access Control Policy ISMSP-AC-02 User Account Management ISMSP-AC-03 Authentication Mechanisms ISMSP-AC-04 Network Access Control ISMSP-SYS-04 Vulnerability Management CFR211-A-3 Section 211.3 - Definitions CFR211-G-122 Section 211.122 - Materials Examination and Usage Criteria CFR211-G-125 Section 211.125 - Labeling Issuance CFR211-G-130 Section 211.130 - Packaging and Labeling Operations API1164-02 Risk Management Framework API1164-06 Access Control API1164-07 Remote Access API1164-09 Patch and Vulnerability Management DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management DSO-2 Data Security DSO-3 Data Access Management IEC62443-02 System security categorization IEC62443-07 Personnel risk assessment IEC62443-08 Electronic access perimeter management IEC62443-10 Revocation of access procedures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.2 Personnel ISO-15189-6.7 Service agreements ISO27799-01 ePHI access controls and authorization ISO27799-08 Information access management ISO27799-12 Unique user identification and authentication ISO27799-17 Facility access controls 27010-8.1 Membership Onboarding 27010-8.2 Membership Termination 27010-9.1 Access Control to Shared Information 27010-9.2 Authentication of Sources 27011-1 Scope 27011-3 Terms and definitions 27011-5.3 Segregation of duties 27011-8.1 User Endpoint Devices ISO27019-02 System security categorization ISO27019-07 Personnel risk assessment ISO27019-08 Electronic access perimeter management ISO27019-10 Revocation of access procedures 29115-11 Mapping other authentication schemes 29115-12.1 Exchanging authentication results 29115-12.2 Controls for mitigating threats 29115-3 Terms and definitions NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing OWASPLLM-1 Prompt Injection and System Prompt Leakage (LLM01 + LLM07) OWASPLLM-2 Improper Output Handling and Misinformation (LLM05 + LLM09) OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) OWASPLLM-6 Excessive Agency and Unbounded Consumption (LLM06 + LLM10) ASD37-18 Restrict administrative privileges (Essential) ASD37-20 Multi-factor authentication (Essential) ASD37-23 Protect authentication credentials (Excellent) CAT-D3-1 Preventative controls CAT-D4-3 Third-party access controls CAT-IRP-4 Organizational characteristics FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) FDBR-SensitiveData-Children-VoiceFacial Sensitive Data, Children's Privacy and Voice/Facial Recognition (Fla. Stat. 501.711, 501.1735) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 60601-1.7.1 Equipment identification and marking IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPAPI-2 Broken Authentication and Token Management OWASPAPI-3 Broken Object Property Level Authorization (BOPLA) PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight PSPF24-4 Physical Security IM8-DAT.1 Data Classification IM8-RES.2 Disaster Recovery IM8-SEC.2 Access Control 58.1 Scope 58.3 Definitions AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment 62351-2 Glossary of terms 62351-8 Role-based access control (RBAC) ISO-14064-1-5.1 Organizational boundaries ISO-14064-1-5.4 Categorization of indirect GHG emissions ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO28001-PI-01 Personnel Security Screening ISO28001-PS-01 Facility Security ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system 23837-1.1 Scope 23837-1.7.3 Authentication and classical post-processing ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27014-1 Scope 27014-3 Terms and definitions 27400-3 Terms and definitions 27400-6.1 Secure Device Design 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy BIPA-SEC5-1 Biometric Identifier Definition BIPA-SEC5-2 Biometric Information Definition STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-5 Protect-P Access Control (PR.AC-P) NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-6 Phased Application and Enforcement SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) SWIFTCSCF-6 Detect Anomalous Activity (Objective 6) C1 Organizational Boundary C3 Scope 1 and 2 Coverage PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection AMLCTF-35 Identity Verification Standard APPI-A26 Report of Leakage to the Commission and Notification to the Person 4.4.1 Resources, Roles, Responsibility, and Authority AZ-DPA-2 Article 2 - Basic Concepts COBIT-BAI02 Managed requirements definition CA-ITSG33-SC-01 Security Control Catalogue QMSR-820.45 Device labelling and packaging controls (§820.45) FFIEC-05 Roles and responsibilities definition CA-9 Internal System Connections CA-9 Internal System Connections UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7) Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ISO-26262-3-5 Item definition ISO20000-15 Access management for services ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions 29134-3 Terms and definitions ITIL4-15 Access management for services NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards 2.2.2 2.2.2 Vendor default accounts managed AUPRV-4 APP 10-11 Quality, Security of Personal Information RUSPD-2 Lawful Basis, Consent, Notice TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights ACE-CR-4 Cargo Release Authorization CPSC-CS.2 Authentication and Access Controls USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern CYB-2 Account Security Measures VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 350 it maps to, and the evidence behind each claim, over MCP and REST.