Mapped to NIST 800-171 Requirement: 3.1.20
CMMC Assessment Objective: AC.L2-3.1.20[d]
What This Objective Means
This assessment objective confirms that your organization has written rules requiring that portable storage devices must be tied to an identifiable owner before they are approved for use. Ownership may be:
• A named user
• A department or team
• A specific system or function
The policy must clarify that ownership must be verified and recorded as part of the authorization process.
Why It Matters
If a device is approved but lacks clear ownership:
• There’s no accountability if it’s lost, misused, or stolen
• It becomes difficult to track usage or investigate incidents
• Devices can be swapped, shared, or re-used without oversight
Tying devices to people or teams promotes responsibility and secure handling.
How to Implement It
• Update your access control policy to include a requirement that all portable storage devices:
◦ Must be registered before use
◦ Must include ownership information
◦ Must be reviewed periodically
• Align procedures to enforce this requirement, including:
◦ An approval or request form capturing owner, purpose, and device ID
◦ Documentation showing device lifecycle (provisioning, retirement, reassignment)
• Train staff on the expectation that anonymous devices are prohibited
Evidence the Assessor Will Look For
• Policy language requiring ownership identification as part of device authorization
• Authorization forms or workflow records capturing ownership data
• Procedures documenting how device ownership is reviewed or transferred
• Training or awareness materials explaining the ownership requirement
Common Gaps
• Devices are approved for use but not assigned to any user or department
• Shared or communal devices circulate without tracking
• No records tying device ID to an accountable owner
How Cuick Trac Helps
Cuick Trac supports this control by:
• Minimizing the use of portable storage in favor of secure, centralized file access
• Helping organizations create clear authorization workflows with ownership documentation
• Supporting integration with device management tools to enforce and track device assignments
• Providing policy templates that include ownership and lifecycle requirements for storage media
With Cuick Trac, every device has a name attached to it—and every action tied back to a user.
Final CTA
Authorization without ownership is a gap in accountability.
Schedule a Cuick Trac demo and bring portable storage under full control—starting with who’s responsible.