Mapped to NIST 800-171 Requirement: 3.1.18
CMMC Assessment Objective: AC.L2-3.1.18[a]
What This Objective Means
You must maintain visibility over all mobile devices that touch CUI. These include:
• Laptops (even if used occasionally offsite)
• Smartphones and tablets with access to CUI systems or apps
• USB drives or portable external hard drives
• Any other portable device with local or remote access to CUI
This objective supports later requirements related to encryption, access control, and physical protection of mobile systems.
Why It Matters
Mobile devices are high-risk endpoints due to their:
• Portability (and risk of loss or theft)
• Use on untrusted networks (e.g., home Wi-Fi, public hotspots)
• Varying levels of control and security
If a mobile device contains CUI—even temporarily—it must be inventoried, tracked, and protected.
How to Implement It
• Create a mobile device inventory that includes:
◦ Device type and owner
◦ Device identifiers (e.g., serial number, hostname, MAC address)
◦ Operating system and version
◦ Whether the device stores, processes, or transmits CUI
• Include all devices:
◦ Company-issued
◦ Personally owned (BYOD), if permitted under policy
◦ Used for remote access or temporary transfer
• Review and update the inventory regularly (monthly or quarterly)
Evidence the Assessor Will Look For
• A current inventory of mobile devices that handle CUI
• Identification of which users or roles are assigned to each device
• Policies or procedures that reference the tracking and classification of mobile assets
• Screenshots or exports from MDM tools (if used)
Common Gaps
• No distinction between mobile and non-mobile systems in asset inventory
• Devices used for temporary access (e.g., consultants’ laptops) not tracked
• No documentation of personally owned mobile devices accessing CUI
How Cuick Trac Helps
Cuick Trac supports this control by:
• Centralizing CUI in a controlled enclave, reducing the need to store CUI on mobile endpoints
• Helping organizations document and track approved mobile devices
• Preventing unauthorized mobile access through strict session and role-based controls
• Supporting mobile device security policy development and inventory best practices
With Cuick Trac, mobile device exposure is minimized—and monitored by design.
Final CTA
Mobility adds flexibility—but also risk.
Schedule a Cuick Trac demo and take control of every mobile device that touches your CUI.