Portable Storage Use

frameworkCMMC Level 2 sectionAC Access Control csf 2.0ID.AM-02 ID.AM-04 topics— frameworks1 0 0

Official textLimit use of portable storage devices on external systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of AC.L2-3.1.21 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-02 ID.AM-04	Inventories of software, services, and systems managed by the organization are maintained; Inventories of services provided by suppliers are maintained	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
ISO 27001	A.5.9 A.5.22	Inventory of information and other associated assets; Monitoring, review and change management of supplier services	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
CIS v8.1	CIS 2.1 CIS 15.1 CIS 1.2 CIS 1.3	Establish and Maintain a Software Inventory; Establish and Maintain an Inventory of Service Providers…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping +5 more loosely related (not mappings) CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 1 more in the downloads
SOC 2	CC6.1 CC9.2	Logical access security over information assets; Managing vendor and business partner risk	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
PCI DSS	12.8.1 6.3.2 6.4.3 12.5.1	List of third-party service providers kept; Inventory of custom software and its components…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping +3 more loosely related (not mappings) 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF ID.AM-04: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF ID.AM-04: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF ID.AM-04: related, not a mapping
800-53	AC-20	Use of External Systems	Crosswalk	NIST SP 800-171r3 03.01.20 → SP 800-53 5 loosely related (not mappings) SA-9 External System Services Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CM-8 System Component Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping PM-5 System Inventory Loosely related Only shares CSF ID.AM-02: related, not a mapping SA-5 System Documentation Loosely related Only shares CSF ID.AM-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF ID.AM-04: related, not a mapping
HIPAA	§164.308(b)(1)§164.308(b)(4)§164.314(a)§164.314(a)(2)(i)	Business Associate Contracts and Other Arrangements; Written Contract or Other Arrangement…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping +5 more loosely related (not mappings) §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF ID.AM-02: related, not a mapping …and 1 more in the downloads
GDPR	Art.30(1)Art.28(1)	Records of processing activities; Processor	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
NIS2	12.4	Asset inventory	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)Art.28(8)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping +1 more loosely related (not mappings) Art.30(2) Key contractual provisions Loosely related Only shares CSF ID.AM-04: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping
Cyber Essentials	CE 3 CE 4	Security Update Management; User Access Control	Loosely related	No mapping. Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.