Mapped to NIST 800-171 Requirement: 3.7.4
CMMC Assessment Objective: MA.L2-3.7.4
What This Control Means
Before using any removable media or external software tools for system testing, maintenance, or diagnostics, your organization must verify they are free of malware. This applies to:
• Third-party diagnostic tools
• System recovery media
• Vendor-provided utilities
• Field service USB sticks
• Bootable troubleshooting disks or flash drives
Even trusted sources can carry hidden threats.
Why It Matters
Unscanned media can introduce malware into secure systems—especially CUI environments—leading to:
• Data exfiltration
• Unauthorized remote access
• System compromise or downtime
• Regulatory and compliance failures
This control closes a common gap in secure maintenance workflows.
How to Implement It
1. Develop a Media Scanning Policy
• Define when and how removable media must be scanned
• Require antivirus or endpoint protection to check all tools/media before use
2. Use Approved Scanning Tools
• Perform scans on a dedicated, isolated system (not the live CUI environment)
• Ensure antivirus/EDR is up to date and configured to scan removable devices
3. Maintain a List of Approved Media and Tools
• Use only vendor-verified, signed, or internally approved programs
• Track and verify software hashes when possible
4. Document the Scanning Event
• Record:
◦ Date/time of scan
◦ Tool used
◦ Person responsible
◦ Result of the scan (clean/infected/quarantined)
5. Train Staff
• Ensure IT, security, and support teams are trained to scan before use
• Prohibit unscanned or unauthorized media on sensitive systems
Evidence the Assessor Will Look For
• Scanning policies for removable media and diagnostic tools
• Logs showing media was scanned before use
• Antivirus/EDR configurations that scan external media
• Training records for maintenance and support staff
• Media control procedures tied to system maintenance workflows
Common Gaps
• Field techs plug in tools without scanning
• Malware introduced from trusted-looking but infected drives
• No formal scanning policy for diagnostic or test media
• Antivirus not configured to auto-scan removable media
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing policies that require pre-use scanning of all external media
• Blocking unscanned media from being used on enclave-connected systems
• Logging scanning activity and results for auditability
• Providing templates for secure tool approval workflows
• Helping build scanning processes into your change and maintenance procedures
With Cuick Trac, every device and tool is verified before it touches your environment.
Final CTA
Trusted tools can still carry threats. Scan first. Always.
Schedule a Cuick Trac demo to strengthen your media scanning process and protect against hidden threats.