CMMCpedia
Work with me

Requirements / Access Control (AC)

AC.L2-3.1.21

Portable Storage Use

Official Source Material

SPRS score value
1 point.
POA&M eligibility
Eligible at a conditional assessment.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Limit use of portable storage devices on external systems.

Determine if:

  1. [a] the use of portable storage devices containing CUI on external systems is identified and documented;
  2. [b] limits on the use of portable storage devices containing CUI on external systems are defined; and
  3. [c] the use of portable storage devices containing CUI on external systems is limited as defined.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

The scenario is your CUI thumb drive in somebody else's computer.

External systems are the ones outside your control: hotel kiosks, personal machines, another company's laptops, and even systems inside your own company that sit outside the CUI boundary. The three objectives ask you to decide whether that use happens at all [a], set the limits [b], and keep to them [c].

Policy and training are the accepted mechanism.

No technical agent of yours runs on an external system, so administrative control is the honest answer: a written rule, training against it, and a signed acknowledgment. The simplest defensible limit is a prohibition: portable storage devices containing CUI are never used on external systems. If you prohibit, [a] and [b] are one sentence each and [c] is the training record.

If you allow it at all, run a check-out process.

Issue company-owned encrypted drives from IT for a named purpose, restrict them to named systems, and log them out and back in. The log is the identification and documentation [a] asks for, and the issuance conditions are the limits under [b].

Encryption does not answer this requirement.

An encrypted drive protects the data if the drive is lost. It does nothing to limit where the drive is used, and an authorized user can still unlock it on a personal machine. Device encryption lives in the Media Protection family. The limit here is about where, and it is behavioral.

Edge cases

  • Device-binding tools exist that let a drive unlock only on systems you manage, turning the written limit into a technical one. They strengthen [c] but are not required, because assessments accept the policy-and-training answer.

Over-engineering

  • A port blocking product bought for this requirement. This requirement limits your CUI drives on other people's systems, and a written limit with training is the accepted mechanism.
  • A check-out register in an organization that forbids portable storage outright. Where you prohibit the practice, the prohibition and the training record are what [b] and [c] need.