CCI-002585

Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

Implementation Guidance

The organization being inspected/assessed does not use portable storage devices in organization information systems when such devices have no identifiable owner.

Validation Procedures

The organization conducting the inspection/assessment examines a sampling of portable storage devices used in the information system to ensure that the devices have an identifiable owner.

Compelling Evidence

1.) Signed and dated SOP or TTP, referencing section which prohibits portable storage for devices with no identifiable owner

The controls below (if any) were marked by NIST as being related to CCI-002585.