Portable Storage Use

The scenario is your CUI thumb drive in somebody else's computer.

CUI is the controlled unclassified information your contract requires you to protect. External systems are the ones outside your control: hotel kiosks, personal machines, another company's laptops, and even systems inside your own company that sit outside the CUI boundary. The three objectives ask you to decide whether that use happens at all [a], set the limits [b], and keep to them [c].

Policy and training are the accepted mechanism.

No technical agent of yours runs on an external system, so administrative control is the honest answer: a written rule, training against it, and a signed acknowledgment. The simplest defensible limit is a prohibition: portable storage devices containing CUI are never used on external systems. If you prohibit, [a] and [b] are one sentence each and [c] is the training record.

If you allow it at all, run a check-out process.

Issue company-owned encrypted drives from IT for a named purpose, restrict them to named systems, and log them out and back in. The log is the identification and documentation [a] asks for, and the issuance conditions are the limits under [b].

Encryption does not answer this requirement.

An encrypted drive protects the data if the drive is lost. It does nothing to limit where the drive is used, and an authorized user can still unlock it on a personal machine. Device encryption lives in the Media Protection family. The limit here is about where, and it is behavioral.