This policy establishes the media protection requirements for establishing an effective media protection program to manage data and information risks that are related to media access, storage, transport, and protection. Media protection shall be based on security best practices with regard to media usage, storage, and disposal.