MPA Content Security Program v5.1

Why does it matter?

A studio is responsible for its content before release, but the content passes through post-production, localization, shipping and cloud vendors that the studio does not run. The Best Practices give those vendors a single minimum benchmark so that one assessment can be reused across customers, and they give content owners a common basis to compare vendors.

Key benefits include:

• One benchmark across studios

The Overview sheet describes a single benchmark of minimum security preparedness for all service providers, so vendors work to one set of controls.

• Fewer redundant assessments

TPN's FAQ lists reduced duplicate assessments and greater visibility through the TPN+ registry as the benefits to service providers.

• Requirements and recommendations kept apart

Each control states the Best Practice, where every component must be met, separately from Implementation Guidance, which the document says is not a requirement.

• Concrete thresholds

Examples include monthly external and quarterly internal vulnerability scans, annual penetration testing and one-year log retention.

• Traceable to other control sets

Each control is mapped to AICPA TSC 2017, CSA CCM v4.0.3, ISO/IEC 27002:2022 and NIST SP 800-53 Rev. 5.

How does it work?

Each Best Practice has a control number that starts with its domain: OR for Organizational Security, OP for Operational, PS for Physical and TS for Technical. For example, OR-2.0 is the Risk Management Program, PS-3.0 the Camera System and TS-4.1 Penetration Testing. A control states its minimum requirements as bullet components, all of which must be met, and then recommended Implementation Guidance that is not required. Two columns, Site and Cloud, show which environment a control applies to.

The controls follow how content moves. Operational Security covers logistics (receiving, packaging, shipping, transport vehicles), data and asset handling, tracking, High Security Titles and Blank Media and Raw Stock; Physical Security covers entry and exit points, visitors, alarms, keys, searches at replication and distribution facilities, cameras and environmental controls. Technical Security covers systems, network, cryptography, vulnerability management and change control, and includes film-specific controls such as Key Delivery Messages and the Trusted Devices List (TS-3.1).

Assessment runs through TPN. A service provider registers on the TPN+ platform, completes the questionnaire, and engages an independent TPN Accredited Assessor, whose cost is contracted separately. From the v5.3.1 assessment onward, TPN reports status in four Shield tiers: Blue (self-assessed), Silver (third-party assessed with a remediation plan), Gold (all Best Practices remediated and reviewed by TPN) and Gold Star (additional recommendations remediated too). An existing Classic Gold Shield stays valid until its assessment expires.

Key Elements

• Organizational Security (OR)

Ten controls, from the Information Security Management System (OR-1.0) and the annual risk assessment (OR-2.0) to background screening, training, contract terms for third parties (OR-3.4) and Incident Management (OR-4.0).

• Operational Security (OP)

Nine controls on receiving, packaging, shipping and transporting physical assets, data and asset classification, tracking, High Security Titles, blank media and disposal.

• Physical Security (PS)

Nine controls including entry and exit points, visitor logs kept at least one year, electronic access control, alarms, keys, searches and camera footage kept at least 90 days.

• Technical Security (TS)

Thirty-six controls across Information Systems, Network Security, Cryptography, Vulnerability Management and Change Control, including AES-256 encryption and multi-factor authentication for remote access (TS-2.9).

• Best Practice and Implementation Guidance

Minimum requirements that must be fully met, paired with recommendations the document says are not requirements.

• Control mappings

Columns mapping each control to AICPA TSC 2017, CSA CCM v4.0.3, ISO/IEC 27002:2022 and NIST SP 800-53 Rev. 5.

What does it cover?

The Best Practices apply to the organizations in the motion picture, television and streaming content pipeline: content owners (studios and others commercially exploiting content), service providers that handle content for them, and the assessors who evaluate those providers. Version 5.1 names Netflix Studios, Paramount, Sony Pictures, Universal, Walt Disney Studios and Warner Bros. Discovery as the MPA member companies on whose behalf the Best Practices are published. They cover both physical sites and cloud or application environments, and the document says they are subject to local, state, regional, federal and country law and do not address every conceivable threat.

What are its objectives?

The MPA publishes the Best Practices to raise the overall level of security preparedness in the media and entertainment industry.

Set recommended minimum security practices for the content pipeline, informed by experienced security professionals and industry feedback.

Establish a common benchmark so the security posture of different vendors can be compared.

Let content owners make independent, risk-based decisions from a single registry of assessed service providers.

Make the practices evolve as threats, technologies, industry practices and legal frameworks change, which is why a new edition appears several times a year.

Keep participation voluntary, with assessment results used for sourcing decisions rather than as a certification.

Framework in Context

The Best Practices sit beside general control frameworks rather than replacing them: v5.1 maps every control to AICPA TSC 2017, CSA CCM v4.0.3, ISO/IEC 27002:2022 and NIST SP 800-53 Rev. 5, and OR-1.0 suggests referencing ISO 27001, NIST 800-53, SANS, COBIT, CSA and CIS when building the ISMS. The Best Practices trace to an initial public release on December 31, 2009, and the 2011 edition consolidated them into Common Guidelines and Supplementals; TPN was created by the MPA and the Content Delivery and Security Association in 2018 and has been wholly owned by the MPA since 2021. Version 5.1 is older than the AI/ML, Zero Trust Architecture and Application Security controls that later editions added.

Common Framework Mappings

The MPA's own control mappings are listed first in the document; organizations also map the Best Practices to these frameworks to reuse evidence across customer audits.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

ISO 27701

MITRE ATT&CK

NIST CSF 2.0