CMMC Removable Media and USB: Control Use, Ownership, Transport, and CUI Without a Blanket Myth

Choose the operating model before buying media

A prohibition model works when business processes can use managed network transfer, approved portals, or other controlled channels instead. Technical controls should block or restrict removable storage and generate useful alerts for attempted use. Define exceptions for recovery media, diagnostic tools, or specialized equipment separately so operators are not forced to bypass the policy during legitimate work.

An approved-media model allows designated portable storage while restricting unknown devices. Issue media through an inventory process, record an identifiable owner or custodian, apply device identifiers where feasible, and define which systems may read or write it. The owner should be a person or accountable organizational role, not a vague label such as 'IT.'

A hybrid model may permit company-issued encrypted media for a machine shop or field team while prohibiting it on ordinary office endpoints. Document the business reason and enforce the difference by device group, endpoint policy, or controlled workstation rather than relying on every employee to remember a nuanced rule.

Make ownership and authorization testable

Requirement 3.8.8 targets portable storage devices that have no identifiable owner. Maintain a media register with serial number or other unique identifier, assigned owner or custodian, purpose, authorization date, permitted system or area, encryption status where applicable, and disposition. Reconcile the register to physical media periodically.

For borrowed or customer-furnished media, decide whether the contractor can establish an identifiable owner and approved handling path before connecting it. Unknown USB drives found in a conference room, received without provenance, or brought from an unmanaged personal system should not become an ad hoc transfer method into the CUI environment.

Authorization should cover the device and the use. An approved company drive does not automatically authorize copying any CUI to any destination. Define which data flows are permitted, who approves external transfer, and how recipient or destination requirements are verified.

Enforce the policy at endpoints and specialized systems

Use endpoint device-control capabilities where they fit the environment: block mass storage, allow-list approved hardware identifiers, restrict write access, require encryption, or alert on insertions. Test the policy with both an approved and unapproved device. The result is stronger evidence than a screenshot of an untested configuration profile.

Specialized assets can complicate enforcement. CNC controllers, test equipment, isolated lab systems, or legacy devices may depend on removable media for software loading or data transfer. Document the specific workflow, scan or staging station, approved media, malware controls, physical custody, and transfer direction. Do not silently exempt the process because conventional endpoint software cannot run on the device.

Consider autorun, executable content, and malware introduction as part of the risk. Restricting which drive can connect does not guarantee the contents are safe. Use scanning, controlled staging, application restrictions, or other safeguards appropriate to the system before media crosses into the assessed environment.

Protect CUI while the media is transported

Requirement 3.8.5 addresses accountability for media during transport outside controlled areas, and 3.8.6 addresses cryptographic protection of CUI stored on digital media during transport unless alternative physical safeguards protect it. Define what counts as leaving the controlled area in the contractor's environment and who is accountable from release through receipt.

If cryptography protects CUI confidentiality, connect the media encryption implementation to the FIPS-validated cryptography requirement in 3.13.11. Do not treat a product label such as 'hardware encrypted' as complete evidence. Record the approved device model or encryption mechanism, configuration, recovery method, and validation mapping where relevant.

Use transfer records for high-value or external movement when appropriate: media ID, sender, recipient, date, destination, purpose, and confirmation of receipt. Packaging and courier controls may be part of the physical safeguard, but they should be defined rather than improvised for each shipment.

Design the exception before someone needs it

If a specialized system genuinely requires removable media, create an exception path with a named owner, approved media type, transfer purpose, source and destination systems, scanning or inspection step where applicable, transport rule, return date, and sanitization/disposition requirement. Make the exception narrow enough that it cannot become a general-purpose thumb-drive program.

For recurring workflows, replace ad hoc approvals with a documented media pool and transaction log. The goal is to know which physical device carried which information between which systems, not merely to know that the drive has a company sticker.

• Named media identifier
• Approved source and destination
• Business purpose and data classification
• Custodian and dates issued/returned
• Protection, inspection, and sanitization steps

Control return, reuse, loss, and disposal

When portable media returns, verify custody and scan or inspect it according to procedure before reuse. If the media changes owner or purpose, update the inventory. Media that can no longer be accounted for should trigger the security response process, including determination of what CUI was present and whether contractual reporting obligations may apply.

Before a device is reassigned, sent for maintenance, returned to a vendor, recycled, or discarded, apply the sanitization or destruction process appropriate to the media and CUI. Encryption does not eliminate the need to make an intentional disposition decision. Retain enough record to show what was sanitized or destroyed, when, by whom, and by what approved method.

Avoid indefinite 'junk drawers' of old USB devices. Unknown ownership and unknown content create exactly the accountability problem the control is meant to prevent. Periodic physical reconciliation should identify media that is missing, obsolete, or no longer justified.

Include media that comes back from a subcontractor, customer site, or field location in the same return workflow. Verify custody, inspect the device according to the approved process before reconnecting it to an in-scope system, and decide whether the media is reused, sanitized, retained, or destroyed. The return path is easy to omit when the policy focuses only on issuing drives.

Test the policy with an unapproved device

During an internal review, connect a non-approved removable device to representative endpoint groups and observe the result. A blocked mount, denied write, security alert, or documented controlled exception demonstrates more than a screenshot of the device-control policy. Repeat the test on specialized workstations where the enforcement method differs from the corporate desktop baseline.

If the system allows the device, determine whether that behavior is intentional. Update the technical rule, asset group, or exception record before assessment rather than explaining the gap after an assessor reproduces it.

Build evidence around a real removable-media transaction

Prepare the removable-media procedure, inventory, approved-device list or prohibition policy, endpoint device-control configuration, transport process, encryption evidence where CUI is carried, and sanitization records. Include any specialized-asset workflow separately so the assessment does not discover it as an undocumented exception.

Demonstrate one real path from issue to disposition: assign an approved drive, connect it to an authorized endpoint, show the technical control distinguishing it from an unapproved drive, transfer permitted data, record external transport if applicable, and return or sanitize it. The evidence should connect identity, device, data flow, and custody.

If the organization prohibits removable storage completely, prove the prohibition on representative in-scope endpoints and explain controlled exceptions such as boot or recovery devices. 'We do not use USB' is not persuasive when the operating system and users remain able to do so without detection.

Common questions

Official sources used for this guide

Open the primary source before making a contract-specific decision. Regulations and program implementation can change.