Detecting and Identifying Ownerless Portable Storage Devices
AC.L2-3.1.20[a] requires organizations to maintain visibility and accountability for portable storage devices that connect to in-scope systems. The assessment objective is straightforward: you must be able to detect removable storage when it is connected, determine who owns or is responsible for the device, and identify any device connected without authorization or known ownership. This applies to organizational devices and personal devices if they are allowed to connect to your environment. The intent is to prevent uncontrolled media from becoming an unmonitored pathway to introduce malware or remove Controlled Unclassified Information (CUI) without detection.
From an assessment perspective, this objective is validated through observable controls and artifacts. A written statement that “unknown USB drives are not allowed” is not sufficient on its own. You must be able to demonstrate how the environment detects portable media events, how ownership is established, and what happens when a device cannot be attributed to an authorized user or department.
Why Ownerless Portable Media Creates Risk in CUI Environments
Portable storage devices (such as USB drives, external SSDs, and memory cards) create risk because they can operate outside normal security controls if they are not managed. An ownerless or unrecognized device can be used to exfiltrate CUI, may contain malware or spyware, and can bypass administrative safeguards when endpoints automatically mount and trust removable media. If you cannot confidently identify the device owner, you cannot validate whether it was approved, whether it is handled according to policy, or whether it is being used for legitimate business purposes.
This objective supports consistent implementation across systems that handle CUI by ensuring that portable storage is either controlled through technical enforcement or reliably detected and investigated. For broader context on CUI compliance requirements, this objective should align with how your organization authorizes devices, manages audit records, and enforces restrictions on removable media in the CUI boundary.
What Assessors Look For During Validation
Assessors typically evaluate this objective by confirming that the organization can answer three questions with evidence: (1) Can you detect when portable storage connects to an endpoint or system? (2) Can you identify who owns or is responsible for the device? (3) Can you identify and respond to any device that is not authorized or has unknown ownership? A control implementation should produce objective artifacts such as connection logs, device identifiers (for example, serial numbers), and records showing how each approved device is assigned.
Assessors may also check whether the process is repeatable and applies consistently. If portable storage is blocked entirely in high-sensitivity zones, they may validate the enforcement configuration and confirm that the control is not limited to one endpoint group. If portable storage is permitted, they may validate that devices are registered, labeled, and traceable to an owner, and that connection events are logged in a way that supports investigation and accountability.
Implementation Options That Meet the Objective
Use device control or endpoint tooling to detect removable media
Implement a technical control capable of detecting removable storage insertion events and capturing relevant details (device type, serial number when available, host name, user context, timestamp). Common approaches include endpoint detection and response (EDR) capabilities, endpoint management tools, or dedicated USB device control solutions. The key requirement is that the system can consistently record portable media connection events for in-scope systems.
Require registration and maintain an inventory tied to ownership
Maintain a portable media inventory that records ownership and authorization status for each approved device. The inventory should include at minimum the device type, a unique identifier (serial number or another stable ID), the assigned user or department, and the authorization status. If your organization uses labels, tagging, or asset management identifiers, ensure that those identifiers map clearly to inventory records. This inventory is central to proving that devices are not “ownerless” when they appear in logs.
Define a handling process for unknown or unrecognized devices
Document what personnel must do when an unrecognized device is found or detected. This should include steps for isolating the device, preventing use until validated, and reporting to the appropriate security or IT function. Where feasible, implement technical settings that block unknown devices by default and require explicit approval to allow use. This supports the assessor’s expectation that ownerless devices are not silently accepted in the environment.
Train users on the risks of connecting unknown media
Train staff on why unknown portable media is prohibited or restricted and what actions to take if a device is encountered. Training should address common scenarios such as found USB drives, third-party devices, and personal storage used for convenience. Training is not a replacement for technical enforcement, but it strengthens adherence and reduces accidental violations. For organizations aligning to NIST 800-171 compliance, training and procedures should be consistent with the documented access control and media handling requirements.
Evidence to Maintain for Assessment
Evidence should demonstrate both detection capability and ownership accountability. Maintain artifacts that show device events are logged, approved devices are traceable to an owner, and unknown devices are addressed through defined actions.
- Portable media inventory showing device identifiers and assigned ownership
- Logs showing detected removable storage connections (including user/device context where available)
- Screenshots or exports from device control, endpoint management, or monitoring tools
- Policy and procedure language describing authorization, registration, and handling of unrecognized devices
- Training materials and completion records addressing unknown portable storage handling
Common Gaps That Create Findings
- No process to track or review portable storage connection events
- Devices are used without labeling, ownership assignment, or documented approval
- Found or third-party USB devices are used without validation, scanning, or registration
- Logging exists but does not capture device identifiers or cannot be correlated to an owner
- Controls are applied inconsistently across endpoints or locations in scope
Implementation and Evidence Mapping Table
| Control expectation | Implementation action | Primary artifact | Assessor-ready evidence |
|---|---|---|---|
| Detect portable storage connections | Enable endpoint or USB control detection for removable media events | Endpoint/USB control configuration | Log samples showing insertion events with host/user context |
| Identify device ownership | Maintain an inventory mapping devices to an assigned owner or department | Portable media inventory | Export showing serial/ID, owner, authorization status |
| Distinguish authorized vs. unauthorized devices | Require registration and define authorization status for each device | Registration/approval process record | Approval tickets or records tied to inventory entries |
| Handle unknown or ownerless devices | Define steps to isolate, report, and prevent use until validated | Procedure for unrecognized devices | Incident/ticket examples or documented response workflow |
| Reduce user-driven risk | Train personnel on found USB devices and prohibited behaviors | Training content | Training completion records and policy acknowledgment |
FAQ
What does AC.L2-3.1.20[a] require?
It requires you to detect portable storage devices connected to your systems and identify whether each device has known ownership and authorization.
Why are ownerless portable storage devices a concern?
They can be used to introduce malware or remove CUI without accountability because the device is not tied to an approved owner or controlled process.
What evidence supports assessment of this objective?
Assessors commonly review portable media inventories with ownership assignments, logs of device connection events, and procedures for handling unrecognized devices.