03.08.07 Media Use

Statement

• a. Restrict or prohibit the use of {{ insert: param, A.03.08.07.ODP.01 }}.

• b. Prohibit the use of removable system media without an identifiable owner.

Guidance

In contrast to requirement [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.08.01)03.08.01, which restricts user access to media, this requirement restricts or prohibits the use of certain types of media, such as external hard drives, flash drives, or smart displays. Organizations can use technical and non-technical measures (e.g., policies, procedures, and rules of behavior) to control the use of system media. For example, organizations may control the use of portable storage devices by using physical cages on workstations to prohibit access to external ports or disabling or removing the ability to insert, read, or write to devices. Organizations may limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Organizations may also control the use of portable storage devices based on the type of device — prohibiting the use of writeable, portable devices — and implement this restriction by disabling or removing the capability to write to such devices. Limits on the use of organization-controlled system media in external systems include restrictions on how the media may be used and under what conditions. Requiring identifiable owners (e.g., individuals, organizations, or projects) for removable system media reduces the risk of using such technologies by allowing organizations to assign responsibility and accountability for addressing known vulnerabilities in the media (e.g., insertion of malicious code).

Assessment objective

the use of the following types of system media is restricted or prohibited: {{ insert: param, A.03.08.07.ODP.01 }}.

Assessment objective

the use of removable system media without an identifiable owner is prohibited.

Assessment method

• system media protection policy and procedures system use policy procedures for media usage restrictions rules of behavior system audit records system design documentation system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with system media use responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for media use mechanisms for restricting or prohibiting the use of system media on systems or system components

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final