Title

Persistent memory USB devices are not labeled in accordance with the classification level of the data they contain. (Cat II impact)

Discussion

If the persistent memory USB device is not labeled with the appropriate classification level this can lead to the compromise of sensitive data or the compromise of an IS that the device is attached.

Check Content

The reviewer will interview the IAO or SA to verify that the labeling of persistent memory USB devices is in accordance with the classification level of the data they contain.

Fix Text

Label persistent memory USB devices in accordance with the classification level of the data they contain. Disseminate this policy to all users.

Additional Identifiers

Rule ID: SV-6993r1_rule

Vulnerability ID: V-6771

Group Title: Persistent Memory USB Devices Labeled

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.