AC-20(2)

Requirement

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].

Discussion

Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems; system/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms implementing restrictions on the use of portable storage devices].

ID	Assessment Objectives
AC-20(02)	the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using <AC-20(02)_ODP restrictions>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!