# NIST 800-171 3.1.21 Limit use of portable storage devices on external systems.

- Source: https://support.icompaas.com/support/solutions/articles/62000229262-nist-800-171-3-1-21-limit-use-of-portable-storage-devices-on-external-systems-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**  

Limits on the use of organization-controlled portable storage devices in external systems include complete prohibition of the use of such devices or restrictions on how the devices may be used and under what conditions the devices may be used. Note that while “external” typically refers to outside of the organization’s direct supervision and authority, that is not always the case.  Regarding the protection of CUI across an organization, the organization may have systems that process CUI and others that do not. Among the systems that process CUI there are likely access restrictions for CUI that apply between systems. Therefore, from the perspective of a given system, other systems within the organization may be considered “external" to that system. 

  

**Priority**: High  

  

**Category**:  Baseline Security Configurations 

  

**Services Associated with AWS:** 

-   AWS Identity and Access Management (IAM), AWS Organizations, AWS Security Hub

  

**Objective Evidence:**  

-   Administrative: documented policies, standards & procedures  
    Technical: screenshot of the technology used to prevent the use of portable storage devices on external systems.  
    

  

Possible Technology Considerations :

-   Secure Baseline Configurations (SBC) 

  

**What needs to be answered :** 

Are there restrictions or guidelines placed on the use of portable storage devices (USB drives)?

-   Establish Restrictions on Use of Portable Storage Devices on External Systems  
    Description This check ensures that restrictions are in place for the use of organization-controlled portable storage devices on external systems. Restrictions may include complete prohibition of such devices or limitations on how and under what conditions they can be used.
-   Enforce Prohibition of Portable Storage Devices on External Systems  
    Description This check verifies that the use of organization-controlled portable storage devices is completely prohibited on external systems, providing a stringent control measure to prevent unauthorized access or data breaches.
-   Implement Usage Policies for Portable Storage Devices  
    Description This check confirms that usage policies are in place for organization-controlled portable storage devices on external systems. The policies define how the devices may be used and specify the conditions under which they can be used, ensuring proper control and management of portable storage devices.  
    

**  
More Details:**  

Policies and controls in place regarding storage of company information on removable media.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.