// ITSP.10.171 · FAMILY 08 · 7 REQUIREMENTS

Media protection

Last verified: 2026-10-05

// REQUIREMENTS

Identifier	Requirement	Level 1
03.08.01	Media storage
03.08.02	Media access
03.08.03	Media sanitization	Level 1
03.08.04	Media marking
03.08.05	Media transport
03.08.07	Media use
03.08.09	System backup (cryptographic protection)

// INTENT

Protected data on removable and portable media is controlled from creation to destruction.

// WHAT A FIRST ASSESSMENT FINDS

USB sticks with engineering data in every drawer, and dead drives in a box under the bench.

// THE WORK

Encrypt what moves, sanitize what leaves to a recognized method (ITSP.40.006 is the Canadian guidance; NIST SP 800-88 is the American one), destroy what dies, and keep the receipts. The USB stick culture around engineering data either ends or gets managed with encrypted, inventoried drives.

// HOW WE CAN INTERPRET IT

Mostly policy, with a few products. Encrypted drives such as IronKey for anything that moves, BitLocker with the TPM on anything that can be lost, and a preference for moving files through the server rather than on a stick. The audit conversation is about the end of the drive's life. It was transferred to a drive, fine, where is that drive now? "We threw it out" is not an answer. Drilled, photograph it, and know that drilling on its own isn't a recognized sanitization method under the Cyber Centre's ITSP.40.006 or NIST SP 800-88; platters still hold data around the hole. Spinning disks get degaussed or shredded, solid state gets a cryptographic erase and then the shredder, and either way it gets logged. Sent to a vendor, get the certificate of destruction. And then show it happened for every drive, not just the one you remembered. One more item that catches people: on failed drives under warranty, ask the vendor for media retention so the dead drive never leaves the building, because the replacement process otherwise ships your data back to the manufacturer.

// TEMPLATES FOR THIS FAMILY

Media handling policy and sanitization log Build it in the policy builder

References

Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)April 2025, updated October 2025
Canadian Centre for Cyber Securitycyber.gc.caRetrieved Oct 5, 2026
NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsRevision 3
NISTcsrc.nist.govRetrieved Oct 5, 2026

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.