Navigate

AC-20(5)

AC-20(5): Portable Storage Devices — Prohibited Use

Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.

Supplemental

Limits on the use of organization-controlled portable storage devices in external systems include a complete prohibition of the use of such devices. Prohibiting such use is enforced using technical methods and/or nontechnical (i.e., process-based) methods.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Int-A, Int-B, Int-C

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AC-20(5).

Control	Description
MP-7	a: [one of "restrict"/"prohibit"] the use of [types of system media to be restricted or prohibited from use on systems or system components are defined;] on [systems or system components on which the use of specific types of system media to be restricted or prohibited are defined;] using [controls to restrict or prohibit the use of specific types of system media on systems or system components are defined;] ; and b: Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
PL-4	a: Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b: Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system; c: Review and update the rules of behavior [frequency for reviewing and updating the rules of behavior is defined;] ; and d: Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [one or more of "{{ insert: param, pl-04_odp.03 }} "/"when the rules are revised or updated"].
PS-6	a: Develop and document access agreements for organizational systems; b: Review and update the access agreements [the frequency at which to review and update access agreements is defined;] ; and c: Verify that individuals requiring access to organizational information and systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [the frequency at which to re-sign access agreements to maintain access to organizational information is defined;].
SC-41	[one of "physically"/"logically"] disable or remove [connection ports or input/output devices to be disabled or removed are defined;] on the following systems or system components: [systems or system components with connection ports or input/output devices to be disabled or removed are defined;].

Enhancements

The controls below (if any) add on to the requirements of AC-20(5).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-20(5).

CCI	Definition
CCI-003759	Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.