MP.L2-3.8.8
Shared Media
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.8 in the reference catalog with its NIST cross-references
Official requirement
Prohibit the use of portable storage devices when such devices have no identifiable owner.
Assessment objectives
a. the use of portable storage devices is prohibited when such devices have no identifiable owner.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prohibit portable storage devices without an identifiable owner.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are the IT manager. One day, a staff member reports finding a USB drive in the parking lot. You investigate and learn that there are no labels on the outside of the drive to indicate who might be responsible for it. You send an email to all employees to remind them that IT policies expressly prohibit plugging unknown devices into company computers . You also direct staff members to turn in to the IT help desk any devices that have no identifiable owner [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; system use policy; procedures addressing media usage restrictions; system security plan; rules of behavior; system configuration settings and associated documentation; system design documentation; system audit logs and records; other relevant documents or records
Common mistakes
Using found or shared storage media with no accountable owner.