CMMC Practice MP.L2-3.8.8

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Monarch ISC Guidance

The clarification from CMMC suggests a policy and training driven approach to satisfy the prohibition of portable storage devices without a clear owner. There are technical solutions available which would block all but known devices. Your organization should consider these solutions in your environment. For instance, if you utilize Microsoft Active Directory, you can disable the use of removable storage using Group Policy.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

DRAFT NIST SP 800-171 R2 Requiring identifiable owners (e.g., individuals, organizations, or projects) for portable storage devices reduces the overall risk of using such technologies by allowing organizations to assign responsibility and accountability for addressing known vulnerabilities in the devices (e.g., insertion of malicious code).