MP.L2-3.8.7
Removeable Media
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.7 in the reference catalog with its NIST cross-references
Official requirement
Control the use of removable media on system components.
Assessment objectives
a. the use of removable media on system components is controlled.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control removable media use on system components.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations. You establish a policy for removable media that includes USB drives [a]. The policy information such as: • only USB drives issued by the organization may be used; and • USB drives are to be used for work purposes only [a]. You set up a separate computer to scan these drives before anyone uses them on the network. This computer has anti-virus software installed that is kept up to date.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; system use policy; procedures addressing media usage restrictions; system security plan; rules of behavior; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Allowing unrestricted USB storage because users need USB peripherals.