Shared Media

Official Source Material

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Determine if:

[a] the use of portable storage devices is prohibited when such devices have no identifiable owner.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

The owner can be the organization, a team, or a person. Every device must trace to someone accountable.

The guide names individuals, organizations, and projects as acceptable owners. The common pattern is company-owned drives issued to named people, with the issuance recorded. A device inventory with an owner column is the evidence for [a].

The found USB drive is the scenario this requirement exists for.

A drive in the parking lot has no identifiable owner and never gets plugged in. Say so in policy, cover it in awareness training, and tell people to hand any drive they find to IT. The assessment guide's own example is exactly this drill.

Back the prohibition with a technical default.

A rule the computer enforces works better than a rule people must remember. Configure device control so unknown storage devices are blocked or read-only and only issued, inventoried drives can be written to. This is the same mechanism that MP.L2-3.8.7 uses, so one configuration serves both requirements.

MP.L2-3.8.8 tightens MP.L2-3.8.7 rather than repeating it.

MP.L2-3.8.7 decides which kinds of media are allowed at all. This requirement adds that even an allowed kind is prohibited when the specific device cannot be traced to an owner. Your MP.L2-3.8.7 exception list satisfies it automatically as long as every excepted device has an owner on record.

What falls short

A device-control allowlist keyed to device models rather than issued devices. Allowing any drive of an approved model says nothing about who owns the one plugged in, so [a] is unmet for unowned devices of that model.