Removable Media

This requirement restricts what plugs into your systems. MP.L2-3.8.1 restricts who touches your media.

The assessment guide draws the contrast itself. Here the question is whether a flash drive or external disk can be used on a workstation at all, and under what rules. Answer it with a deliberate stance: which device types are allowed, on which systems, for whom.

Default deny, allow by exception, enforce with software.

A policy is a control, but a policy plus enforcement is a control an assessor can test. Block removable storage through your endpoint management or endpoint protection tooling, then allow specific issued devices by exception for people with a business need. The exception list doubles as your MP.L2-3.8.8 ownership record.

Nontechnical controls are legitimate where technical ones do not fit.

The guide accepts policies, procedures, and rules of behavior as controls, and physical measures like port blockers on machines that cannot run device-control software. A shop floor machine with a policy sign-off and a physical port lock is controlled. A network with no stance on USB drives is not.

This is a five-point requirement, so settle it before assessment.

32 CFR 170.24 lists MP.L2-3.8.7 among the five-point derived requirements. Under 32 CFR 170.21, its point value keeps it off any POA&M, the plan of action and milestones that lets certain gaps be closed after assessment. Device control in a modern endpoint suite is hours of work, not a project. Do it early.