This objective ensures that your access control policies and procedures clearly prohibit the use of any portable storage device that lacks ownership or cannot be attributed to an approved user, particularly in systems handling Controlled Unclassified Information (CUI).