- Restrict removable storage through endpoint policy to approved, encrypted, registered devices — deny by default, allow by documented exception.
- In OT environments removable media is often the sanctioned transfer mechanism into segmented or air-gapped zones; a governed transfer process with scanning stations works, a blanket ban that operations must route around does not.
3.8.7OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.8.7 — Removable media control
3.8 Media Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Control the use of removable media on system components.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
USB drives and memory cards do not connect at will. Technical policy decides which removable media may be used, by whom, and on which systems — with a written exception path instead of quiet workarounds.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Endpoint policy exports showing removable-media restrictions
- The exception register with owners and review dates
- Scanning-station or transfer-process records where that pattern is used
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |