AC.L2-3.1.21
Portable Storage Use
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.21 in the reference catalog with its NIST cross-references
Official requirement
Limit use of portable storage devices on external systems.
Assessment objectives
a. the use of portable storage devices containing CUI on external systems is identified and documented;
b. limits on the use of portable storage devices containing CUI on external systems are defined; and
c. the use of portable storage devices containing CUI on external systems is limited as defined.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Limit the use of organizational portable storage devices on external systems.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your organization, which stores and processes CUI, has a written portable device usage restriction policy. It states that users can only use external storage devices such as thumb dives or external hard disks that belong to the company. When needed for a specific business function, a user checks the device out from IT and returns it to IT when no longer needed [a,b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing the use of external systems; system security plan; system configuration settings and associated documentation; system connection or processing agreements; account management documents; other relevant documents or records
Common mistakes
Allowing company USB media to move freely between approved and unapproved systems.