The organization:
Physically controls and securely stores [FedRAMP Assignment: [all types of digital and non-digital media with sensitive information]] within [FedRAMP Assignment: see additional FedRAMP requirements and guidance]; and
MP-4a Additional FedRAMP Requirements and Guidance:
Requirement: The service provider defines controlled areas within facilities where the information and information system reside.
Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.