AC.L2-3.1.21Portable Storage Use
Limit use of portable storage devices on external systems.
[a]
the use of portable storage devices containing CUI on external systems is identified and documented;[b]
limits on the use of portable storage devices containing CUI on external systems are defined; and[c]
the use of portable storage devices containing CUI on external systems is limited as defined.
No org USB on home PCs; portable media only on managed endpoints
Implementation
AO coverage. Addresses all Portable Storage Use objectives regarding external systems.
Limit. Portable storage that may hold CUI is org-issued, hardware-encrypted, and only mountable on managed enclave endpoints. Policy prohibits using those drives on home/personal PCs or hotel business centers.
External systems. Staff acknowledge that CUI portable media is not connected to unmanaged external systems. Spot checks via MDM device reports and random interviews.
Maintenance. Exception tickets time-bound (≤30 days). Lost-media process mirrors sanitization SOP.
Accepted gap. A supplier still requires DVD drop-ship. Disc is encrypted archive; burned only on a dedicated air-gapped burner host; courier chain-of-custody logged.
What the evidence looks like
- MDM USB policy
- Issued encrypted-media inventory
- User acknowledgment / training record
- DVD exception chain-of-custody sample
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.