Skip to content
ControlVerdict
Sign in
MP.L2-3.8.8CMMC Level 2Level 2

Shared Media

Submit your own example

Practice statement

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.8.8.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(1)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the use of portable storage devices is prohibited when such devices have no identifiable owner.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    MP.L2-3.8.8Shared Media
    Prohibit the use of portable storage devices when such devices have no identifiable owner.

    • [a]

      the use of portable storage devices is prohibited when such devices have no identifiable owner.

    No identifiable owner, no port: found drives go in the amnesty bin

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses the Shared Media objective: use of portable storage devices is prohibited when the device has no identifiable owner.

    What identifiable owner means here. A portable storage device may be used only if it appears in the media inventory with an asset tag and a named custodian. Vendor giveaways, drives found on the floor or in the lot, drives inherited from a departed employee without a custody record, and unlabeled drives in a drawer all fail that test by definition — and we say so in the policy in exactly those words, because 'no identifiable owner' is otherwise interpreted generously by people who need to move a file right now.

    Technical enforcement. Because device control allow-lists specific device identifiers, an unowned drive physically cannot mount on a managed endpoint. This is the same mechanism as the removable media practice, and it is what makes the prohibition real rather than aspirational; the policy language alone would not survive a deadline.

    The amnesty bin. A drop box in the IT area accepts found or unwanted media with no questions asked and no incident opened for the finder. Contents go to the destruction queue. Telling people they will not get in trouble is what stopped the previous behavior of plugging in a found drive to see whose it was — which is, of course, the entire attack.

    Awareness. The annual module covers the drop-attack scenario with the giveaway-stick framing, since that is the version people actually encounter. New hires are told during onboarding that conference swag drives do not work on company equipment and why.

    Inventory hygiene. Issued media is asset-tagged, physically labeled with the custodian, and reconciled quarterly. A drive whose custodian has left and whose custody was not transferred is treated as unowned: it is wiped or destroyed, not reassigned informally.

    Maintenance. Quarterly inventory reconciliation; annual review of the amnesty bin volume as an awareness signal — a bin that never fills up may mean people are not using it rather than that no drives are being found.

    Accepted gap. Personal drives on personal home equipment are outside our technical reach. Policy prohibits placing CUI on any device not in the inventory, remote access is limited to managed endpoints, and data loss prevention blocks the download paths that would make it easy.

    What the evidence looks like

    • Policy text defining identifiable owner and prohibiting unowned media
    • Media inventory with asset tags and named custodians, plus the quarterly reconciliation
    • Device control allow-list demonstrating that unlisted devices cannot mount
    • Amnesty bin procedure and destruction queue records
    • Awareness module content covering the drop-attack scenario

    Environment

    Trade-show season brings home a steady supply of giveaway USB sticks, and drives turn up in the parking lot and in returned laptop bags a few times a year.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.