What this requirement asks
Limit use of portable storage devices on external systems.
This is a CMMC Level 2 requirement in the Access Control family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.1.21[a] — the use of portable storage devices containing CUI on external systems is identified and documented
- 3.1.21[b] — limits on the use of portable storage devices containing CUI on external systems are defined
- 3.1.21[c] — the use of portable storage devices containing CUI on external systems is limited as defined
What an assessor examines
Examine:
- Access control policy
- procedures addressing the use of external systems
- system security plan
- system configuration settings and associated documentation
- system connection or processing agreements
- account management documents
- other relevant documents or records
Interview:
- Personnel with responsibilities for restricting or prohibiting use of organization-controlled storage devices on external systems
- system or network administrators
- personnel with information security responsibilities
Test:
- Mechanisms implementing restrictions on use of portable storage devices
Evidence that defends it
Show device control policies; logs of blocks/allow exceptions
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.