Mapped to NIST 800-171 Requirement: 3.8.8
CMMC Assessment Objective: MP.L2-3.8.8
What This Control Means
You must ensure your organization:
• Does not allow the use of “found,” anonymous, or unregistered portable storage devices
• Has technical and administrative safeguards in place to enforce this prohibition
• Has policies and procedures that direct users to report unidentified devices rather than using them
This control focuses on reducing risks from rogue or compromised devices, which are often used to deliver malware or steal data.
Why It Matters
Using an unknown or “rogue” USB stick is a major security risk:
• Malware can automatically execute upon insertion
• Attackers can use disguised devices to extract data or install backdoors
• There is no accountability for what data is accessed or altered
• It may result in the unauthorized introduction or exfiltration of CUI
Enforcing this control closes a dangerous gap in endpoint security.
How to Implement It
1. Establish a Clear Policy
• Prohibit use of any portable media that:
◦ Is not assigned to a specific person or role
◦ Is found without a known source
◦ Has not been approved by IT or security
2. Require Device Registration
• Maintain a list or inventory of portable storage devices
• Tag and assign devices to specific users, roles, or systems
3. Block Unauthorized Devices Technically
• Use endpoint protection or GPOs to:
◦ Block unknown USBs
◦ Allow only approved/whitelisted devices
4. Train Staff
• Instruct employees to:
◦ Never plug in unrecognized devices
◦ Report unknown devices to IT/security immediately
◦ Understand the risk of malware introduction via USB
5. Enforce Disposal Protocols
• Destroy or safely store unidentified devices—never return them to use
Evidence the Assessor Will Look For
• Policy that prohibits use of unidentified portable devices
• Asset register or inventory of approved USBs/media
• System configurations that block unknown devices
• Security awareness training content referencing this policy
• Records of any past incidents involving unidentified media (and how they were handled)
Common Gaps
• Staff unaware of the risk of unknown media
• “Lost and found” USBs plugged in without scanning
• No tracking of device ownership
• Endpoint settings allow all USBs by default
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Blocking unregistered or unknown portable media across all endpoints
• Maintaining a device inventory and ownership log
• Enforcing encryption and tagging on all authorized removable storage
• Alerting administrators when an unapproved device is inserted
• Training users and enforcing policy at the point of use
With Cuick Trac, unauthorized devices never have the chance to compromise your CUI.
Final CTA
If you don’t know where it came from—don’t let it connect.
Schedule a Cuick Trac demo to lock out unknown media and keep your CUI systems safe.