Mapped to NIST 800-171 Requirement: 3.1.20
CMMC Assessment Objective: AC.L2-3.1.20[a]
What This Objective Means
This control is about visibility and accountability. You must be able to:
• Detect portable storage devices connected to your systems
• Determine who owns or is responsible for each device
• Identify which devices, if any, are connected without authorization or known ownership
The objective applies to both authorized systems and personal devices connecting to your environment.
Why It Matters
Ownerless portable storage devices are a significant risk because they can:
• Be used to exfiltrate CUI
• Contain malware or spyware
• Operate outside of any formal security controls
If you don’t know where a device came from or who owns it, you can’t trust it—and shouldn’t allow it.
How to Implement It
• Implement USB device control or endpoint detection and response (EDR) solutions that:
◦ Detect all removable storage devices when plugged in
◦ Require user or device registration
◦ Maintain logs of device connections
• Maintain a portable media inventory that includes:
◦ Device type and serial number
◦ Assigned user or department
◦ Authorization status
• Train staff on the dangers of connecting unknown devices (e.g., found USBs)
Evidence the Assessor Will Look For
• Device inventory showing ownership assignments
• Logs of detected USB or portable device connections
• Screenshots from USB control or monitoring software
• Policy or training materials addressing how to handle unrecognized devices
Common Gaps
• No process to track or review device connections
• Devices used without labeling, ownership, or approval
• Found or third-party USBs used in the environment without scanning or validation
How Cuick Trac Helps
Cuick Trac supports this control by:
• Limiting or blocking the use of portable storage within the secure enclave
• Helping organizations document ownership and authorization for any approved devices
• Supporting device control integrations that detect and log all removable media activity
• Providing policy guidance on device identification, approval, and monitoring
With Cuick Trac, unidentified storage devices are either disallowed—or promptly reported and removed.
Final CTA
If you don’t know who owns it, it shouldn’t be plugged in.
Schedule a Cuick Trac demo and keep unowned devices out of your CUI environment.