Navigate

AC-20(2)

AC-20(2): Portable Storage Devices — Restricted Use

Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [restrictions on the use of organization-controlled portable storage devices by authorized individuals on external systems are defined;].

Supplemental

Limits on the use of organization-controlled portable storage devices in external systems include restrictions on how the devices may be used and under what conditions the devices may be used.

CIA Levels
Confidentiality	low
Integrity	unknown
Availability	unknown

Overlays
CMMC, Classified, DAF Baseline, Int-A, Int-B, Int-C

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-20(2).

Control	Description
MP-7	a: [one of "restrict"/"prohibit"] the use of [types of system media to be restricted or prohibited from use on systems or system components are defined;] on [systems or system components on which the use of specific types of system media to be restricted or prohibited are defined;] using [controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;] ; and b: Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
SC-41	[one of "physically"/"logically"] disable or remove [connection ports or input/output devices to be disabled or removed are defined;] on the following systems or system components: [systems or system components with connection ports or input/output devices to be disabled or removed are defined;].

Control

Description

MP-7

a: [one of "restrict"/"prohibit"] the use of [types of system media to be restricted or prohibited from use on systems or system components are defined;] on [systems or system components on which the use of specific types of system media to be restricted or prohibited are defined;] using [controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;] ; and

b: Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.

SC-41

[one of "physically"/"logically"] disable or remove [connection ports or input/output devices to be disabled or removed are defined;] on the following systems or system components: [systems or system components with connection ports or input/output devices to be disabled or removed are defined;].

Enhancements

The controls below (if any) add on to the requirements of AC-20(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-20(2).

CCI	Definition
CCI-000097	Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions.
CCI-003758	Defines the restrictions for the use of organization-controlled portable storage devices.