CMMC AC.2.006 - Limit Storage Devices

CMMC AC.2.006 - Limit Storage Devices

Requirement text: AC.2.006: Limit use of portable storage devices on external systems.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 
Limits on the use of organization-controlled portable storage devices in external systems
include complete prohibition of the use of such devices or restrictions on how the devices
may be used and under what conditions the devices may be used. Note that while
“external” typically refers to outside of the organization’s direct supervision and authority
that is not always the case. Regarding the protection of CUI across an organization, the
organization may have systems that process CUI and others that do not. Among the
systems that process CUI there are likely access restrictions for CUI that apply between
systems. Therefore, from the perspective of a given system, other systems within the
organization may be considered “external" to that system.

CMMC CLARIFICATION
A portable storage device is a system component that you can insert and remove from a
system. You use it to store data or information. Examples of portable storage devices
include:
      • floppy disks;
      • compact/digital video disks (CDs/DVDs);
      • flash/thumb drives;
      • external hard disk drives; and
      • flash memory cards/drives that contain nonvolatile memory.

You can put this practice in place two ways:
      • set up a policy that describes the usage restrictions of these devices or
      • establish technical means, such as configuring devices to work only when connected
      to a system to which they can authenticate.

Example
Your organization has a usage restriction policy. It states that users cannot use portable
storage devices in external information systems without management approval.

References
​• NIST SP 800-171 Rev 1 3.1.21
• CIS Controls v7.1 13.7, 13.8, 13.9
• NIST CSF v1.1 ID.AM-4, PR.PT-2
• NIST SP 800-53 Rev 4 AC-20(2)​

    • Related Articles

    • CMMC AC.1.003 – Limit External Connections

      Requirement text: AC.1.003: Verify and control/limit connections to and use of external information systems. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 External systems are systems or components of systems for which organizations typically have ...

    • CMMC AC.1.001 – Limit Information System Access

      Requirement text: AC.1.001: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Access control ...

    • CMMC MP.3.123 - Prohibit Portable Storage Devices with no Identifiable Owner

      Requirement text: MP.3.123: Prohibit the use of portable storage devices when such devices have no identifiable owner. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Requiring identifiable owners (e.g., individuals, organizations, or projects) for ...

    • Access Control: SP 800-171 Security Family 3.1

      Access is the ability to make use of any system resource. Access control is the process of granting or denying requests to:       • use information,       • use information processing services, and       • enter company facilities.  System-based ...

    • CMMC AC.3.022 - Encrypt Mobile Devices

      Requirement text: AC.3.022: Encrypt CUI on mobile devices and mobile computing platforms. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Organizations can employ full-device encryption or container-based encryption to protect the confidentiality of ...