AC-20(2): Portable Storage Devices

Control Family:

Access Control

Parent Control:

AC-20: Use Of External Information Systems

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

ID.AM-4
PR.AC-3

Threats Addressed:

Information Disclosure

Baselines:

Moderate
High

Next Version:

NIST Special Publication 800-53 Revision 5:
AC-20(2): Portable Storage Devices – Restricted Use

Control Statement

The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.

Supplemental Guidance

Limits on the use of organization-controlled portable storage devices in external information systems include, for example, complete prohibition of the use of such devices or restrictions on how the devices may be used and under what conditions the devices may be used.

Control Statement

Supplemental Guidance

Related Controls

Critical Security Controls Version 8