CCI-003758

Implementation Guidance

Determine if the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [AC-20(02)_ODP; restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined].

Validation Procedures

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external systems; system configuration settings and associated documentation; system connection or processing agreements; account management documents; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Mechanisms implementing restrictions on the use of portable storage devices].