AC-20(4)

Requirement

Prohibit the use of [Assignment: organization-defined network accessible storage devices] in external systems.

Discussion

Network-accessible storage devices in external systems include online storage devices in public, hybrid, or community cloud-based systems.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing use of network-accessible storage devices in external systems; system design documentation; system configuration settings and associated documentation; system connection or processing agreements; list of network-accessible storage devices prohibited from use in external systems; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems; system/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms prohibiting the use of network-accessible storage devices in external systems].

ID	Assessment Objectives
AC-20(04)	the use of <AC-20(04)_ODP network-accessible storage devices> is prohibited in external systems.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!