AC.L2-3.1.21 Portable storage use: requirements and evidence

What AC.L2-3.1.21 portable storage use requires for CUI

If you are the compliance lead or engineer who has to show that a USB drive or external hard disk holding CUI cannot simply be carried onto an outside computer, this requirement is your starting point. The organization must identify where portable storage containing CUI may be used on external systems, define the limits on that use, and enforce those limits. Identifying and documenting the permitted use is the first step, because an assessor will ask for a written definition before testing whether anything actually stops a drive from leaving the boundary. The NIST SP 800-171A assessment objectives for 3.1.21 break the requirement into exactly these three parts, so your evidence should map to each of them.

The risk is straightforward. CUI copied to removable media can leave the authorized environment in a bag or a pocket, and it can be opened on a home computer, a conference room laptop or a vendor's machine that the system security plan never considered. The hard part is not writing the rule. It is the exceptions. Personal devices, shadow IT tools, a field engineer who needs to load files onto a customer's equipment, and a manager who wants a drive for a single project all push against a restriction that looks clean on paper. Each exception needs a documented business reason, an approver and a technical control that limits what the device can do, or the restriction exists only in policy.

Plan for this requirement as a 1-point item in the Level 2 score under 32 CFR 170.24, so it rarely decides an assessment on its own, but it still needs to be met. Under the scoring rules in 32 CFR 170.21, it is not on the exclusion list, so it may sit on a plan of action and milestones if your score meets the threshold stated in that rule, with closeout required within the period the rule sets. Confirm the current score threshold and closeout period against the eCFR text before you rely on a POA&M, because the CMMC schedule has been changing. Treat the POA&M as a short bridge, not a plan to defer the control.

Which systems, media and people fall under portable storage limits

AC.L2-3.1.21 only bites where CUI meets a device or system you do not control, so scoping starts by mapping where CUI lives and where it can leave. The cards below cover the decisions that change the workload most: the systems in scope, the external machines staff use, the storage media that count, and the teams who move media around.

CUI-processing systems in scope

Start with the systems that store, process or transmit CUI and the boundary around them. Portable storage limits apply to CUI that leaves those systems and reaches an external system. Document each CUI system, its data flows and the people who can copy data out of it. A system that never holds CUI sits outside this requirement, but you must be able to show that boundary to an assessor. Confirm the boundary against your system security plan before you scope the work.

External systems staff actually use

External systems include personal computers, customer or partner machines and shared conference kiosks. Each one is a place where a USB drive could copy CUI outside your control. Inventory where staff work from, including home offices and travel, and identify which external machines they plug into. Assessors will ask how you identified and documented that use, so keep the list current and tie each entry to a stated rule.

Portable storage devices that count

The CMMC Assessment Guide names CDs and DVDs, USB drives, external hard disk drives, flash memory cards and floppy disks as portable storage. Include phones or cameras that mount as storage, since they behave the same way. Build a device list that covers each type your staff could realistically use, not only the USB sticks you issue. Missing one media type is a common reason a scope review looks incomplete.

Teams that move media

Field service, maintenance and support staff often carry diagnostic drives, firmware files and backup media between sites. Maintenance contractors may bring their own storage to your equipment. Identify each team that handles media containing CUI, including outside vendors, and document what they may carry and where. These teams need the same rules as office staff, and their contracts or procedures should reflect them.

Exceptions that need written approval

Some roles need to write to removable media, such as an engineer loading software onto a test system. Each exception should name the role, the device, the business reason and the approving owner. Record who approved it, when it expires and how its use is logged. Assessors look for exceptions that are approved and reviewed, not informal workarounds, so treat undocumented exceptions as gaps.

How an assessor tests AC.L2-3.1.21 step by step

This table walks through the three NIST SP 800-171A assessment objectives for AC.L2-3.1.21, showing what an assessor does for each, the evidence requested and the gaps that most often stop a requirement from being scored as MET. Read it in order, because each objective depends on the one before it.

Assessment step	What the assessor does	Evidence requested	Common findings
1. Identify and document use of portable storage with CUI on external systems	Asks how the organization knows where portable storage holding CUI is used outside the assessed system, and reviews whether that use is recorded	Inventory or register of external systems, documented procedures for external system use, and system connection or processing agreements where they apply	No record of which external systems staff use with removable media, or the procedure exists but nobody follows it
2. Define limits on that use	Reads the written rule for portable storage and checks that it sets clear limits, such as which devices are allowed, which external systems are allowed and what data may move	Approved policy or standard covering portable storage containing CUI, with device types named (for example, USB drives and external hard disk drives, as listed in the CMMC Assessment Guide Level 2)	Policy is general, says 'use removable media responsibly' without limits, or does not mention CDs, DVDs, flash memory cards or external hard disks
3. Limit use as defined	Tests whether the defined limits are enforced in practice, including any technical mechanisms that restrict portable storage devices on endpoints	Configuration exports or screenshots of device control settings, endpoint policy results, exception approvals and account management records showing who may use exceptions	Limits exist only on paper, device control is set to audit only, or exceptions are granted with no approval record
Test of enforcement mechanisms	Samples several endpoints and checks that the restriction works as configured, often by attempting to use a portable device on a test system	Dated configuration evidence from the device management or endpoint tool, plus results from a sample of endpoints	Restriction is applied to some device groups but not others, or settings drift after updates and nobody re-checks them
Final evidence review	Confirms that each applicable objective is satisfied with evidence in final form, not drafts, before scoring the requirement	Approved and dated documents, current configuration outputs and records that match the assessment period	Draft policies, undated screenshots or evidence that does not reflect the system as it operates today
Scoring outcome	Marks AC.L2-3.1.21 MET only when all applicable objectives are satisfied, since the requirement carries 1 point	Consistent evidence across all three objectives for the same system boundary	Partial evidence leaves the requirement NOT MET, which affects the total score and any POA&M decision

How to implement portable storage limits in six steps

This sequence takes an organization from knowing where CUI sits on removable media to proving with test results that its portable storage limits hold on external systems. Each step produces a named artifact that an assessor can review.

Inventory CUI and the media that carry it
Start by mapping where CUI is created, stored, processed and transmitted within the assessment scope, then identify every point where it could be copied to portable storage such as USB drives, external hard disks, flash memory cards and optical discs. Assign an owner to each system and workflow that handles CUI. The output is a data flow inventory and a list of endpoint classes that can write to removable media. The step is complete when the system owner signs off that the list matches how users really work, not only how the policy says they work.
Define permitted uses and limits in a written standard
Write a portable storage standard that states which external systems may receive CUI on portable media, under what conditions, and which uses are prohibited outright. Define the limits in measurable terms, such as which device types are allowed, who may approve them, and whether copying to a personal device is ever permitted. Map the standard to the system security plan and the external system agreements already in place. The output is an approved, versioned standard with named owners, and the step closes when leadership has formally approved it.
Approve a portable storage media list
Build an approved media list that records each permitted device by make, model or device identifier, serial number range, owner and the business purpose it serves. Pair it with a list of external systems that may exchange CUI through that media. Remove anything that cannot be tied to an approved purpose. The output is the approved media list, which becomes the reference that technical controls and exception reviews are checked against.
Configure technical enforcement on endpoints
Enforce the standard on endpoints with device control, which blocks mass storage classes by default and allows only approved device identifiers. Require encryption for any permitted removable media so that CUI on a lost device stays protected. Where the platform cannot block a class of device, document the compensating control and its limits. Open-source options such as osquery can report attached devices and the state of the configuration across a fleet, and Fleet policies can ask a yes or no question of each device, such as whether removable storage is blocked. Confirm each capability with the platform vendor before relying on it. The output is an exported device control configuration and a fleet report showing which endpoints pass.
Record exceptions and approvals
Create a formal exception process for cases where a user needs portable media outside the approved list. Each request should state the device, the CUI involved, the external system, the business reason, the duration of the need and the approving owner. Approved exceptions must be added to the device control configuration with a documented expiry and reviewed on a set schedule. Keep the request, the approval and the matching configuration change together so an assessor can trace each one. The output is an exception register that matches the live configuration.
Train users on the rules and their reasons
Brief every user who handles CUI on the portable storage standard, the approved media list and the exception process. Explain what counts as portable storage, which external systems are off limits, and how to request an exception. Record attendance and keep the training material under version control so the content matches the standard at the time of training. The output is training records tied to user accounts, which show that the people who can reach the media were told the limits.
Test that the limits hold and retain the results
Run a planned test that tries to write CUI to an unapproved device, to copy to an unapproved external system and to use an expired exception. Check that each attempt is blocked or logged, and that the results match the written standard. Repeat the test after configuration changes and keep the results with the date, scope and tester. Assessors look for test results and exception records alongside the standard, so retain the full set. The output is a dated test report with pass or fail results per objective, and the step closes when every failure has a documented fix or an approved, time-limited exception.

Evidence that satisfies portable storage use and how to keep it current

Assessors test AC.L2-3.1.21 by reading documents that define the limits and tooling that enforces them, then checking that the records match what the systems actually did. The cards below cover each artifact type and how to keep it current between assessments, so the evidence reflects operations rather than a single audit-week snapshot.

Written portable storage standard

This is the document that defines the limits on portable storage containing CUI on external systems: which device types are covered (such as USB drives, external hard disks and flash memory cards), which external systems they may touch, and which uses are prohibited. Assessors check that the limits are defined, not just that a policy exists. Confirm that the standard names a responsible owner, an approval path for exceptions and a review date.

Inventory of devices and external systems

Keep a register of the external systems where CUI-bearing portable storage may be used, and of the removable devices authorized for that use, with owner, purpose and approval date. An inventory that matches what endpoints report is far more persuasive than one assembled from memory. Ask whether the register lists devices by serial number or identifier, since that is what allows a later query to be reconciled against it.

System connection and processing agreements

Where CUI is used on an external system, the agreement that governs that use, such as a system connection or processing agreement, shows the boundary was authorized before the device moved data. Assessors look for the agreement, its signatories and whether the terms restrict portable storage. Review these agreements when the external party changes, when a service is added or when the contract renews, and record each review date.

Account management documents

Account records show who can plug in and use removable media on each system, and whether that authority is tied to a role. Export the group or role membership that controls device access, along with the approval record for each change. Recertify memberships on a schedule and keep the signed review, because a stale list of users with device rights is one of the most common gaps assessors find.

Device control configuration exports

Configuration exports from endpoint management or device control tooling are the technical proof that limits are enforced. Capture dated exports of the relevant settings, such as device class restrictions or allow lists, and store them with the version of the policy they implement. Use a scheduled export written to a retained location, rather than a screenshot taken for the audit alone, so the history shows the setting was in force throughout the period.

Logs and query results of blocked or permitted use

Sample logs or query results showing that removable media was blocked, or permitted only for approved devices, demonstrate the control operating. Scheduled osquery queries or Fleet policies can report which hosts have removable storage attached, and Wazuh or Velociraptor can collect the same evidence across a fleet. Keep dated results from recurring runs and review them monthly, recording the reviewer and any follow-up action.

Exception approvals and periodic review records

Any device that falls outside the standard needs a written exception with a named approver, a justification, a compensating control and an expiry date. Assessors read these to confirm that exceptions are deliberate and bounded. Pair exceptions with a quarterly review that confirms each one is still needed and that closed exceptions were removed from the configuration. The signed review record is what keeps this evidence current between audits.

What it costs to meet AC.L2-3.1.21

This table breaks down the cost components of limiting portable storage use under AC.L2-3.1.21, showing who is paid for each, whether it is one-time or recurring, and what drives it up. No supplied source gives a dollar figure or duration for these components, so use the drivers column to scope your quote and request line-item pricing from each provider. The main takeaway is that licensing is only one part of the cost, and engineering, exception handling and evidence upkeep usually recur every assessment cycle.

Cost component	One-time or recurring	Who is paid	What drives it
Device control or endpoint tooling licenses	Recurring	Software vendor or reseller	Fleet size, OS mix, and whether existing endpoint management already blocks removable media. Ask for per-device pricing and renewal terms.
Engineering time to configure and test	One-time, with periodic retesting	Internal IT or an implementation partner	Number of external-system scenarios, operating systems, and how many device classes must be restricted. Ask for a fixed-scope estimate with test cases listed.
Policy and exception process	Recurring	Internal compliance and security staff	Number of approved business exceptions for removable media and how often they are reviewed. Ask how exception records are approved and retained.
User training	Recurring	Internal training staff or a training provider	Headcount that handles CUI and turnover. Ask whether training is bundled with the awareness and training requirements.
Evidence upkeep	Recurring	Internal system owners	Frequency of configuration exports, device inventory updates and policy reports. Ask which evidence the assessor will review and in what format.
External testing or readiness review	One-time per readiness cycle	Independent assessor or consultant	Scope of the test, number of endpoints sampled, and whether a mock assessment is included. Confirm that the reviewer is independent of the implementation work.
Auditor sampling	Recurring at each assessment	Certified third-party assessor (C3PAO) or the assessing body	Number of systems and devices sampled and the depth of evidence requested. Ask the assessor for its fee structure before scoping.
Open-source tooling in place of licenses	One-time setup, recurring operations	Internal staff or implementation partner for setup	Engineering effort to deploy and maintain the platform, plus hosting inside your own infrastructure. Ask for the support scope and upgrade plan in writing.

Open-source tools that produce portable storage evidence

Assessors reviewing AC.L2-3.1.21 look for proof that portable storage use on external systems is identified, limited and enforced. The tools below can produce parts of that proof from endpoints, but each one answers a different question, and none of them is a substitute for a written usage restriction. Confirm each capability against your own environment before you rely on it in an assessment.

osquery device and process queries

osquery exposes hardware events, running processes and file hashes as SQL tables, and the osqueryd daemon can run those queries across a fleet of hosts. For AC.L2-3.1.21, that gives you a repeatable way to show which endpoints recorded USB or other removable hardware events and which processes were running when they did. Your organization still has to define the limit and show the query results match it. Confirm which hardware event tables your operating systems expose before you write the query set. osquery is dual-licensed under Apache-2.0 OR GPL-2.0-only, so choose the license that fits your distribution and legal review.

Fleet yes or no policies

Fleet policies are yes or no questions asked of devices as osquery queries, such as whether a removable drive is currently mounted or whether a defined device control is active. The policies page shows which devices in each fleet pass or fail, which gives assessors a current, per-device view instead of a one-time export. Write each policy to match a stated limit on portable storage, then keep the pass and fail history as evidence. Fleet is MIT licensed. Confirm whether any policy can enforce a block, or whether it only reports, because the facts supplied do not establish blocking support.

Wazuh configuration assessment checks

Wazuh Security Configuration Assessment scans monitored endpoints against YAML policies, mostly based on CIS benchmarks, and checks files, directories, registry keys and running processes. You can add custom policies that test the settings your portable storage limit depends on, such as a configuration file or registry value that governs removable media. The scan output and remediation recommendations become dated evidence of the setting and any drift. Confirm that your chosen policy checks the actual control your organization uses, and treat a passing scan as one piece of evidence. Wazuh is licensed under GPL-2.0-only.

Velociraptor artifact hunts

Velociraptor collects forensic artifacts defined in VQL from endpoints and runs hunts that collect one or more artifacts across a group of systems. Offline machines are scheduled to collect when they reconnect, and each hunt gets a notebook for analyzing the combined results. This suits a point-in-time check such as finding every system where removable media was used with CUI, or confirming that a monitored device list matches reality. Confirm that your artifacts reach the storage and device data you need on each operating system. Velociraptor is licensed under AGPL-3.0-only, which can impose source disclosure duties if you modify and offer it over a network, so review that obligation with counsel before deployment.

Who owns the portable storage control and who can help

Your organization owns AC.L2-3.1.21. The organization decides which portable storage devices may touch CUI, which external systems are in scope for the restriction, and what the defined limits are. Those decisions must be written down, approved by someone with authority over the system security plan, and applied by the people who operate the endpoints. An outside party can draft the wording, but it cannot approve the policy on your behalf or accept the residual risk.

Policy and limits: Define which device types (for example USB drives, external hard disks and flash memory cards) are restricted, and under what conditions any exception is allowed.
Approvals: Record who authorized each permitted use of portable storage containing CUI on an external system, and keep those approvals current.
Enforcement settings: Own the endpoint and device control configuration, including who can change it and how changes are logged.
Operational review: Review fleet query results and exceptions on a regular cadence, and act on failing devices.
System security plan entries: Keep the description of the control consistent with what the systems actually do.

Before engaging any outside party, confirm that your internal owner for this requirement can explain the policy, the approvals and the enforcement settings without relying on a consultant.

Where portable storage controls usually fall short

Most portable storage problems are not missing technology. They come from a limit that was never written down, a device list that skipped removable media, controls nobody tested, exceptions with no record, and machines that sit outside the inventory. Each gap below affects what an assessor can test for AC.L2-3.1.21 Portable storage use, and each has a practical fix.

No written usage limits

If the organization has not defined when portable storage containing CUI may be used on external systems, there is nothing for an assessor to measure. SP 800-171A expects the organization to define the limits and then apply them. Write a short rule that names the approved external systems, the classes of media allowed, and the conditions for use, such as encryption and a documented business need. Get the rule approved and tie it to the system security plan so the assessor can trace it.

Device list that ignores media

Many inventories cover USB drives and nothing else. The CMMC Assessment Guide names CDs and DVDs, USB drives, external hard disk drives, flash memory cards and floppy disks as portable storage. An inventory that leaves out optical discs, SD cards or external drives leaves gaps that a reviewer may find during testing. Build the list from the assessment guide categories, then check endpoint telemetry for connections of each type to confirm the list is complete.

Controls that exist but are never tested

A device control policy in an endpoint tool proves little until someone shows it works. Test each restriction on a representative machine: plug in an unapproved drive, confirm it is blocked or logged, and save the result. Repeat the test after operating system updates or policy changes. Keep the test records, because an assessor may ask for proof that a mechanism restricts portable storage use, not just a screenshot of its configuration.

Exceptions granted without records

Business needs often lead to informal approvals, such as a verbal okay for a field engineer to copy files to a drive. Each exception should have a named approver, a scope, an expiration date and a compensating control such as encryption or monitoring. Store the approvals with the access records so the organization can show that every exception followed the defined limits. Undocumented exceptions are the usual reason a control that looks sound fails in practice.

Personal devices and outside machines

Staff may plug personal drives into work laptops, and contractors may bring their own machines to a site that handles CUI. These systems are often outside the inventory that the control is built around. Define which external systems are in scope, state how personal and visitor media are handled, and check for connections from unmanaged devices using endpoint logging. Confirm with your own assessor how external systems are bounded, since the answer shapes what evidence you need.

POA&M status under suspension

AC.L2-3.1.21 is a 1-point requirement, so under 32 CFR 170.24 it can sit on a POA&M for Conditional Level 2 status if the score is at least 88 of 110, with closeout due within 180 days. Confirm the current position before you rely on this route. The Department of War suspended CMMC Phase II on 13 July 2026, and its interim guidance on enforcement should be checked with your contracting officer and the official DoW CIO CMMC pages.

Common questions about portable storage use requirements

How much effort does portable storage control AC.L2-3.1.21 take?

The effort depends mostly on how many systems handle CUI, how many people use removable media, and how much enforcement already exists. Most of the work is definition and evidence rather than new technology: the organization must identify where portable storage containing CUI may be used on external systems, define the limits on that use, and show that the limits are enforced. Organizations that already restrict USB storage through endpoint policy usually need less effort than those that have never written a rule. Ask any provider to break the effort into policy work, endpoint configuration, reporting and evidence collection, and to state which of those are one-time and which recur each assessment cycle.

Can we implement portable storage controls in-house?

Yes, many organizations do this in-house, because the control is owned by the organization and an assessor will test the organization's own configuration and records. The main questions are whether your team can write a defensible usage rule, configure device restrictions consistently across endpoints, and keep the evidence in final form. Outside help is usually a choice about capacity and experience, not a requirement. An implementation partner can prepare systems, configuration baselines and evidence packages for a fixed scope, but it does not assess the control or issue any report. A certification body or independent assessor makes the determination.

What skills and staff does the portable storage control need?

The work needs people who can translate policy into technical settings and people who can prove the settings work. In practice that means an owner for the usage policy, endpoint administrators who can apply device restrictions, and someone who maintains the inventory of systems in scope. Security engineers typically review exceptions and test enforcement. The team should be able to:

Define which storage devices are covered, such as USB drives, external hard disks and flash memory cards
Configure and verify restrictions on each external system that touches CUI
Query endpoints for evidence and retain results in a form an assessor can review

How long does it take to implement portable storage controls?

The duration depends on the size of the fleet in scope, how many policy exceptions must be documented, and whether endpoint tooling is already in place. A small, uniform environment with existing device management can move faster than a mixed estate with many unmanaged machines. No fixed duration is given here. Ask for a timeline in the written scope that lists the systems covered, the policy decisions the client must make, and the dates on which evidence will be delivered. Timelines also depend on the client's own review and approval steps.

Can a POA&M cover the portable storage requirement?

AC.L2-3.1.21 is a one-point requirement that is not on the exclusion list for POA&M items, so it can be placed on a plan of action and milestones under the Conditional Level 2 rules, provided the overall score meets the threshold in 32 CFR 170.21 and the item is closed within the required period. Treat this as a rule to confirm with your sponsor and assessor, not as a plan. Because the requirement is simple to evidence, many organizations find it better to close it before assessment rather than carry it forward. Any POA&M entry should name the owner, the interim compensating measure and the closeout date.

What changes now that CMMC Phase II is suspended?

On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so the portable storage control still matters for any CUI on external systems. The suspension changes when a third-party certification may be required, not whether the control must be met. Confirm the current status on the DoW CIO About CMMC page and with your contracting officer before you plan certification dates.

What should a quote for portable storage controls include?

A useful quote lists the scope before the price: the systems and endpoints covered, the external systems where CUI may be used, the operating systems and device management tools in place, and the evidence to be delivered. It should separate one-time work, such as policy drafting and configuration, from recurring work, such as reporting and re-verification before each assessment. Ask who holds each deliverable, what the client must supply, and which items fall outside scope. DeployOpen works from a written scope and provides a quote from that scope. It prepares systems and evidence and does not issue assessment results.

How DeployOpen prepares portable storage evidence

DeployOpen plans, implements and documents the technical controls that limit portable storage use on external systems within your own infrastructure, then hands over the evidence an assessor will review. Your organization owns the policy and the decisions, and an independent assessor or certification body makes the final determination.

How we scope

Confirm which systems hold CUI and which external systems staff may connect to them
Inventory the portable storage device types in use, such as USB drives and external hard disks
Record the scope in a written agreement before any configuration or testing begins

How we build

Deploy endpoint query and policy tooling such as osquery and Fleet to detect removable media on endpoints
Configure policies that flag or restrict portable storage use on external systems against your defined limits
Use Wazuh configuration assessment or Velociraptor hunts to check enforcement across the fleet

How we hand over

Document the defined limits, the enforcement mechanisms and the responsible roles in final form
Export device status reports, policy results and configuration records that match each assessment objective
Walk your team through the evidence set so it can be reproduced at your next assessment

How we support

Support ongoing operation, upgrades and fleet changes as a retainer, if you choose one
Re-run enforcement checks after configuration or policy changes and record the results
Confirm with your assessor or C3PAO which evidence formats they accept before handover