Mapped to NIST 800-171 Requirement: 3.1.20
CMMC Assessment Objective: AC.L2-3.1.20[c]
What This Objective Means
This is the system-level enforcement of your policy prohibiting use of unowned portable storage. The assessor wants to see that your systems are configured to:
• Detect and block unauthorized devices
• Allow only known, approved devices to function
• Record device connections and ownership status
• Prevent or quarantine unknown USB, external drives, and portable media
It applies to both company-owned and personally owned devices that may attempt to connect. This secure system configuration is a critical part of managing cyber security risks.
Why It Matters
Even with strong policies, users may still plug in unauthorized devices out of convenience or curiosity. Without system-level controls:
• These devices may be used to exfiltrate CUI
• Malware could be introduced via removable media
• There’s no way to detect or respond to unauthorized storage use
This objective ensures that technical safeguards match your written expectations and are integral to the cybersecurity risk management process.
How to Implement It
• Use endpoint protection or USB control software to:
◦ Whitelist specific devices by serial number or user
◦ Block or alert on unknown or unauthorized device connections
◦ Require approval before new devices can be used
• Configure group policies or MDM tools to:
◦ Disable USB ports entirely (if appropriate)
◦ Restrict USB storage to read-only
◦ Apply different policies based on user role or device location
• Log all portable media activity and review it periodically
This approach aligns with the cyber risk management framework to enhance your organization’s overall cybersecurity compliance.
Evidence the Assessor Will Look For
• Screenshots or reports from USB/device control systems showing blocked and approved devices
• Group Policy or MDM profiles enforcing media use restrictions
• Logs showing attempted access from unauthorized or unregistered devices
• Testing results showing that unowned devices are denied access automatically
Common Gaps
• Policy exists, but USB ports are not restricted or monitored
• No differentiation between owned and unowned devices at the system level
• Lack of centralized visibility or alerting on portable device activity
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Disabling removable storage by default in the secure enclave
• Offering guidance on configuring endpoint protections for broader system environments
• Helping organizations deploy and document USB control tools that restrict access by device ID
• Logging all attempted media usage for incident response and audit readiness
With Cuick Trac, policy enforcement doesn’t depend on memory or intention—it’s built into your system behavior, ensuring effective cyber risk management and cybersecurity compliance.
Final CTA
The only safe unowned device is one your system doesn’t recognize—and blocks.
Schedule a Cuick Trac demo and enforce storage security where it counts: at the point of connection.