id: "AC-20(05)" title: "Portable Storage Devices — Prohibited Use" family: "AC" family_name: "Access Control" sort_id: "ac-20.05" priority: "P1" implementation_level: "organization" parent: "AC-20" enhancement: True
Statement
Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.
Guidance
Limits on the use of organization-controlled portable storage devices in external systems include a complete prohibition of the use of such devices. Prohibiting such use is enforced using technical methods and/or nontechnical (i.e., process-based) methods.
Assessment Objective
the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.
Access control policy
procedures addressing use of portable storage devices in external systems
system design documentation
system configuration settings and associated documentation
system connection or processing agreements
system audit records
system security plan
other relevant documents or records
Organizational personnel with responsibilities for prohibiting the use of portable storage devices in external systems
system/network administrators
organizational personnel with information security responsibilities