{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-30","description":"Establish, document, and disseminate policies and procedures for asset management, media protection, and physical and environmental protection — including maintenance of a complete asset inventory, secure handling, marking, storage, and sanitization of media, and data retention limits with secure disposal of nonpublic information no longer required for business or legal purposes. Review and update these policies and procedures at defined intervals and upon significant change.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"MP-1","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PE-1","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"500.13","coverage":"partial","delta":"Inventory must track owner, location, classification, support expiration, RTO, plus update frequency","framework":"nydfs-500","relationship":"intersects_with"}],"statement":"Establish, document, and disseminate policies and procedures for asset management, media protection, and physical and environmental protection — including maintenance of a complete asset inventory, secure handling, marking, storage, and sanitization of media, and data retention limits with secure disposal of nonpublic information no longer required for business or legal purposes. Review and update these policies and procedures at defined intervals and upon significant change.","title":"Maintain asset, media, and physical protection policies","unified_id":"UC-GOV-30"},"id":"uc:UC-GOV-30","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-30","sourceIds":["nist-800-53","nydfs-500"],"sourceUrl":null,"title":"UC-GOV-30 — Maintain asset, media, and physical protection policies","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:17e445bf2810dd73a2b59c0be126efbebc1e9d511a6fa05d120890ffd551db40","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","targetId":"uc:UC-GOV-30","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:29831b5ee5e8bb90f834b1b7491ba4feae2fc9470db6d0f146d5ed6f2be694aa","properties":{},"sourceDetailPath":"/data/v1/records/wf-g9-d1e65641.json","sourceId":"wf:G9","targetDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","targetId":"uc:UC-GOV-30","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:486742679251eee307d8152b6f9a096ca040aa201a61fee033cee8ffd6f489b9","properties":{},"sourceDetailPath":"/data/v1/records/wf-c26-0d7976b8.json","sourceId":"wf:C26","targetDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","targetId":"uc:UC-GOV-30","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:53e5d40889536378c608acbfacff804b7d936577fb09f9cad0e0ba757f90ea3b","properties":{"rationale":"Retention limits and secure disposal of nonpublic data reduce over-retention and legal exposure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/risk-compliance-litigation-enforcement-25e7935d.json","targetId":"risk:compliance-litigation-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:64a5a678d76c853e57db846d787716bdefb4c70deed63f468466799e6d810fc1","properties":{"rationale":"Establishing asset-management, media-protection, and physical-protection policies remedies missing policies for this domain.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/risk-gov-policy-absent-cf76dbbf.json","targetId":"risk:gov-policy-absent","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6adc3b8e22e0cb8224da919a8be7821b1cac2f3cfb84d2140e578be07130dc2e","properties":{"control_id":"MP-1","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-mp-1-cfaa1323.json","targetId":"ctrl:nist-800-53:MP-1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a1cad789780242f76181e8f148448be5154a028f9977dd534263375b5a235570","properties":{"control_id":"PE-1","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pe-1-5274aa7f.json","targetId":"ctrl:nist-800-53:PE-1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dd2057920f7f9cceb8904ae17068fd358745d80a95246634a8eb7a8d2c0ce079","properties":{"control_id":"500.13","coverage":"partial","delta":"Inventory must track owner, location, classification, support expiration, RTO, plus update frequency","framework":"nydfs-500","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"23 NYCRR 500, Second Amendment"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-30-6e914c26.json","sourceId":"uc:UC-GOV-30","targetDetailPath":"/data/v1/records/ctrl-nydfs-500-500-13-f6a493b8.json","targetId":"ctrl:nydfs-500:500.13","type":"maps_to"}],"schemaVersion":1}