id: "AC-20(04)" title: "Network Accessible Storage Devices — Prohibited Use" family: "AC" family_name: "Access Control" sort_id: "ac-20.04" priority: "P1" implementation_level: "organization" parent: "AC-20" enhancement: True
Statement
Prohibit the use of {{ insert: param, ac-20.04_odp }} in external systems.
Guidance
Network-accessible storage devices in external systems include online storage devices in public, hybrid, or community cloud-based systems.
Assessment Objective
the use of {{ insert: param, ac-20.04_odp }} is prohibited in external systems.
Access control policy
procedures addressing use of network-accessible storage devices in external systems
system design documentation
system configuration settings and associated documentation
system connection or processing agreements
list of network-accessible storage devices prohibited from use in external systems
system audit records
system security plan
other relevant documents or records
Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems
system/network administrators
organizational personnel with information security responsibilities
Mechanisms prohibiting the use of network-accessible storage devices in external systems