What this requirement asks
Prohibit the use of portable storage devices when such devices have no identifiable owner.
This is a CMMC Level 2 requirement in the Media Protection family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (1)
- 3.8.8[a] — the use of portable storage devices is prohibited when such devices have no identifiable owner
What an assessor examines
Examine:
- System media protection policy
- system use policy
- procedures addressing media usage restrictions
- system security plan
- rules of behavior
- system configuration settings and associated documentation
- system design documentation
- system audit logs and records
- other relevant documents or records
Interview:
- Personnel with system media use responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes for media use
- mechanisms prohibiting use of media on systems or system components
Evidence that defends it
Block or strictly authorize
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.