MPA Content Security Best Practices in Plain English

The Short Answer

The MPA Content Security Best Practices are a spreadsheet of security controls that major studios use as a shared minimum for the vendors that touch their unreleased work. TPN, the Trusted Partner Network, maintains it and builds its assessments on it. As of 15 October 2026, TPN's resources page lists version 5.3.2, published in September 2026, together with an AI Supplemental v1.0.

Which Version Is Current

The version question trips people up because the paperwork around it moves at different speeds.

• TPN's Links and Resources page lists v5.3.2 English and AI Supplemental v1.0, with a file date of 23 September 2026. It describes 5.3.2 as updating and adding controls on AI security and leaves the other 79 non-AI controls unchanged from 5.3.1.
• The version history inside the workbook says 5.3.1 added an Application Security topic, with four new application controls, and 5.3.2 added the AI Supplemental.
• TPN's Quick Start Guide for service providers is dated September 2025 and still calls 5.3.1 the current release.

So the Quick Start Guide is older than the Best Practices file. Before you start, confirm with your assessor which version they will use, and tell your client if their contract names a specific one. Older versions are still published on the same page for reference.

How It Is Organized

The document sorts controls by four domains: Organizational Security, Operational Security, Physical Security and Technical Security. Within those, controls are tagged by topic, such as Access Control, Asset Management, Cryptography, Incident Response, Network Security, Personnel Security, Risk Management, Vulnerability Management and Zero Trust Architecture. Every control has a number like OR-4.0 or TS-2.5, where the prefix shows the domain.

Each control has two layers.

• Best Practices are the minimum. TPN describes them as reflecting the minimum security expectations of most MPA member studios, and each component must be fully satisfied to meet the Best Practice.
• Additional Recommendations add more layers. Studios often require some of them when a title needs extra care.

A column also marks whether each control applies to a site, a cloud environment or an application, so your scope decides which ones you answer.

What the Controls Ask, in Plain English

Organizational: write it down, and train people

You need a security policy leadership has approved, an acceptable use policy that bans posting pre-release material online without written consent, continuity and recovery plans, an annual risk assessment, and an incident response process that covers content incidents as well as IT ones. People controls cover background screening, onboarding, offboarding and training at hire and every year, and they name freelancers and temporary workers as well as employees. See our incident response outline.

Operational: know where every asset is

Track physical and digital client assets with a unique identifier, with the location, time and date of each move, and keep those logs for at least a year. Use aliases for high-security titles. Destroy drives, scripts and discs through a process where the person who handled the asset is not the person who destroys it. Have a work-from-home policy and a policy for remote sites.

Physical: control the rooms

Lock down entry points, log visitors, put electronic access control and alarms on the rooms where content lives, use cameras, and control keys. Keep logs for a year at least, or longer if local rules or agreements say so.

Technical: this is where most of the work is

• Network. Isolate content and production networks from office and internet networks, with VLAN access lists or an air gap. Run a stateful firewall that denies by default. Secure Wi-Fi with WPA2-EAP or WPA3 and keep guests on a separate network. Use VPN for remote access, with no split tunneling and sessions ended after 15 minutes idle.
• Accounts. Unique usernames, multi-factor authentication through an app or hardware key on internet-facing systems and administrator access, passphrases of at least 16 characters, and least-privilege access.
• Systems. Endpoint protection, no local administrator rights without need, USB and mass storage blocked on content systems, screen lock within 15 minutes.
• Encryption. AES-256 for content at rest, and TLS 1.2 or better in transit.
• Vulnerability management. External scans monthly, authenticated internal scans quarterly, penetration tests yearly, and a patching process that includes NAS and network equipment.
• Content transfer. Use dedicated transfer systems, approve transfers, and delete content after 24 hours or per the client.
• Applications and AI. Web portals need HTTPS, role-based access and separation between client tenants. Version 5.3.2 adds AI and machine learning controls, including governance and testing, and moved a rule about importing content into large language models from a recommendation up to a Best Practice.

What It Does Not Cover

The document says of itself that it attempts to set out reasonable practices in ordinary circumstances, may not address every threat, and is not permanent or exhaustive. It also states that translations are for reference, and the English text governs. Meeting every control does not make a studio safe. It makes a studio demonstrably meeting a baseline, which is what content owners use when they decide whom to send content to.

Using It Without Drowning

Do not read it cover to cover on day one. Start with the questionnaire in TPN+ for your scope. It will show only the controls that apply. For the wider picture of why TPN exists, see what TPN is. Then use our readiness checklist to turn the list into tasks, and the gap assessment post to see where shops stumble.

Want a person to help?

A real person on our team can read the current Best Practices with you, translate them into fixes for your network and policies, and organize the evidence. We help you get ready. The assessment is performed by an independent, TPN-accredited assessor, and we do not certify anyone. Start with our TPN certification consulting, or plug us in with a short description of your studio.