id: "AC-20(02)" title: "Portable Storage Devices — Restricted Use" family: "AC" family_name: "Access Control" sort_id: "ac-20.02" priority: "P1" implementation_level: "organization" parent: "AC-20" enhancement: True
Statement
Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using {{ insert: param, ac-20.02_odp }}.
Guidance
Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.
Assessment Objective
the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using {{ insert: param, ac-20.02_odp }}.
Access control policy
procedures addressing the use of external systems
system configuration settings and associated documentation
system connection or processing agreements
account management documents
system security plan
other relevant documents or records
Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems
system/network administrators
organizational personnel with information security responsibilities
Mechanisms implementing restrictions on the use of portable storage devices