AC-20.2: Portable Storage Devices — Restricted Use

Access control policy

procedures addressing the use of external systems

system configuration settings and associated documentation

system connection or processing agreements

account management documents

system security plan

other relevant documents or records

Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems

system/network administrators

organizational personnel with information security responsibilities

Mechanisms implementing restrictions on the use of portable storage devices