Prepare for your TPN assessment against MPA Best Practices
The MPA Content Security Best Practices are a set of minimum security controls that MPA member studios expect from vendors handling their film, television and streaming content. Version 5.3.1 contains 82 controls across four security domains and covers on-site facilities, cloud services and applications. Conformance is measured through Trusted Partner Network (TPN) self-assessments and third-party assessments rather than a certification.
Is MPA Best Practices right for your organisation?
Any service provider or software vendor that receives, processes, stores or delivers content for MPA member studios, including post-production, VFX, localisation, duplication and cloud or application providers. Adoption is voluntary, but content owners commonly require a current TPN Shield before awarding or renewing work, so vendors usually tackle it when a studio asks for it.
It is usually required by customers, partners or schemes rather than by law.
- Published by
- Motion Picture Association (MPA), maintained by Trusted Partner Network (TPN)
- Version covered
- 5.3.1, released 7 August 2025
- Newer version
- 5.3.2 (September 2026) updates AI controls; the 79 non-AI controls are unchanged
- Structure
- 82 controls across 4 domains and 15 topics
- Applies to
- Vendors and software providers handling studio content
- Assessment route
- TPN Shield tiers: Blue, Silver, Gold and Gold Star
- Status
- Voluntary, but often required by content owners
- Type
- Framework (contractual)
- Region
- Global
- In OneClickComply
- Supported today
OneClickComply makes it simple
MPA Best Practices are mapped in OneClickComply's control library and available on request, so your existing controls and evidence can be lined up against all 82 controls. Automated evidence collection, policy generation and continuous monitoring help you build a remediation-ready evidence set before your TPN questionnaire and accredited assessor review.
Requirements covered
82 Best Practice controls in version 5.3.1, grouped into four security domains (Organizational, Operational, Physical and Technical Security) and 15 security topics, each scoped to Site, Cloud or App and paired with Additional Recommendations.
Manual MPA Best Practices vs. OneClickComply
- Working through 82 controls per site and application in spreadsheets
- Chasing screenshots of firewall, MFA and endpoint settings before every assessment
- Writing a dozen policies from scratch to match studio expectations
- Remediation items found by the assessor that block a higher Shield tier
- Repeating the same evidence for ISO 27001, SOC 2 and studio questionnaires
- One control library shows your coverage against every MPA Best Practice
- Evidence is pulled from connected tools automatically and kept current
- Audit-ready policies are generated from your real environment
- Gaps are flagged and supported fixes applied early, before the assessor visits
- Evidence collected once counts towards MPA, ISO 27001 and SOC 2 together
Everything you need for MPA Best Practices
All 82 MPA Best Practice controls mapped to your existing control set
Automated evidence collection for access, endpoint, network and cloud controls
AutoComplete policies for ISMS, acceptable use, BCP, DR and incident response
OneClickFix for supported cloud and identity misconfigurations
Continuous monitoring with alerts when TPN-relevant controls drift
Ask an Auditor guidance and penetration testing for TS-4.1
Three steps to MPA Best Practices compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against MPA Best Practices and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates MPA Best Practices-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
MPA Content Security Best Practices requirements
All 82 Best Practice controls in version 5.3.1, listed by control number with their official TPN+ titles across the Organizational (OR), Operational (OP), Physical (PS) and Technical (TS) Security domains.
| Reference | Requirement |
|---|---|
| OR-1.0 | Information Security Management |
| OR-1.1 | Acceptable Use Policy |
| OR-1.2 | Business Continuity Plan |
| OR-1.3 | Disaster Recovery Plan |
| OR-1.4 | Data & Assets |
| OR-2.0 | Risk Management |
| OR-3.0 | Background Screening |
| OR-3.1 | On-boarding |
| OR-3.2 | Off-boarding |
| OR-3.3 | Training & Awareness Program |
| OR-3.4 | Contracts & Service Level Agreements |
| OR-4.0 | Incident Response |
| OR-5.0 | AI/ML - Security Management |
| OP-1.0 | Receiving |
| OP-1.1 | Packaging |
| OP-1.2 | Shipping |
| OP-1.3 | Transport Vehicles |
| OP-2.0 | Work From Home/Remote Workers |
| OP-2.1 | Remote Sites & Locations |
| OP-3.0 | Tracking |
Always check the official MPA Best Practices text for the exact wording.
MPA Best Practices FAQs
What are the MPA Content Security Best Practices?
The MPA Content Security Best Practices are the film and television industry's single benchmark of minimum security preparedness for anyone handling studio content. They are published on behalf of MPA member studios and maintained by the Trusted Partner Network (TPN). Version 5.3.1 contains 82 controls across Organizational, Operational, Physical and Technical Security, with Additional Recommendations for higher-risk work.
Is compliance with the MPA Best Practices mandatory?
No, adoption is voluntary and they are not law. In practice they are contractual: each content owner decides whether to require conformance in its purchasing process, and many studios expect vendors to hold a current TPN Shield before sharing pre-release content. Losing or lacking that assurance can mean losing access to studio work rather than a fine.
What is the difference between the MPA Best Practices and TPN?
The MPA Best Practices are the control set, and TPN is the programme that assesses against it. TPN, a wholly owned subsidiary of the MPA, maintains the Best Practices, runs the self-assessment questionnaire and accredited third-party assessments, and publishes results on the TPN+ platform so content owners can review a vendor's security posture.
What are the TPN Shield tiers?
From version 5.3.1, TPN uses four Shield tiers. Blue is a self-assessment against the Best Practices. Silver means a TPN-accredited assessor has verified your answers and you have submitted a remediation plan. Gold means every Best Practice gap is remediated and reviewed by TPN. Gold Star adds remediation of all Additional Recommendations. TPN does not issue certifications.
What changed in MPA Best Practices version 5.3.1?
Version 5.3.1, released in August 2025, added an Application Security topic with four new controls covering error handling and logging, session management, hosting and security testing. It split authentication and authorisation into separate controls, added an encryption key management control, added an App scoping column and removed the ISO 27002:2013 mapping column.
How do the MPA Best Practices relate to ISO 27001 and SOC 2?
They overlap heavily. The Best Practices workbook maps each control to ISO 27002:2022, the AICPA Trust Services Criteria used in SOC 2 and NIST SP 800-53. They add industry-specific controls ISO 27001 does not cover in detail, such as content receiving and shipping, high-security titles, transport vehicles and replication facilities. TPN pre-populates matching questionnaire answers if you upload a valid ISO 27001 certificate.
How long does it take to prepare for a TPN assessment?
It depends on the size of your operation and the number of sites and applications in scope, because each site and application is assessed separately. The self-assessment that earns a Blue Shield is free and can be started at any time. Moving to Silver, Gold or Gold Star depends on how quickly gaps are evidenced and remediated.
Does OneClickComply support the MPA Content Security Best Practices?
Yes, on request. The MPA Content Security Best Practices v5.3.1 are mapped in OneClickComply's control library and available on request rather than live as a standard framework today. Once enabled, your existing evidence, policies and monitoring map across to the 82 controls. OneClickComply helps you prepare, but TPN and its accredited assessors carry out the assessment.
Related standards
All standards- MITRE ATT&CK v16Framework · Global
- COBIT 2019Framework · Global
- CSA Cloud Controls Matrix (CCM) v4.1Framework · Global
- CIS Controls v8.1Framework · Global
- CSA IoT Security Controls Framework v2Framework · Global
- CIS Controls v8.1 Implementation Group 3 (IG3)Framework · Global
- CIS Critical Security Controls v8.1 Implementation Group 2 (IG2)Framework · Global
- AICPA Privacy Management FrameworkFramework · Global
Get MPA Best Practices ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.