NIST 800-171 Controls · Media Protection

MP.2.125 — Prohibit use of portable storage without identifiable owner

CMMC Level 2SPRS if unmet: -1MEDIUM priority~2h to implement

Prohibit the use of portable storage devices when such devices have no identifiable owner.

What MP.2.125 means in plain English

If someone finds a USB drive in a parking lot or receives one in the mail unexpectedly, they must NEVER plug it into a company computer. "Unowned" USB drives are a classic attack vector — attackers leave infected drives in parking lots, and curious employees pick them up and plug them in. This control requires both a technical block (your USB policy from the previous control handles this) and a cultural rule: any USB drive must be traceable to a specific approved owner before it can be used. If origin is unknown, destroy or quarantine it.

The assessment question

“Is there a documented policy and technical control prohibiting the use of any removable storage device that lacks an identifiable, authorized owner — and have employees been trained on the risks of unknown media?”

How to implement MP.2.125

Add an explicit prohibition to your Acceptable Use Policy and Removable Media Policy: "No portable storage device may be connected to company systems unless it is assigned to an identified owner in the Removable Media Register and has been pre-approved."
Cover the "USB drop attack" scenario in annual security awareness training — show employees real examples of attacks that began with someone plugging in a found USB drive.
Establish a procedure for handling suspicious/unknown media: employees who find or receive an unknown USB drive must deliver it to the owner/manager for review — it is never plugged into company systems under any circumstance.
The Group Policy block from control MP.2.124 provides the technical enforcement — unknown/unregistered USBs will simply not function on company systems.
Post a visible reminder near workstations and printers: "Found a USB drive? Do NOT plug it in. Give it to [Manager Name] immediately."

Evidence your assessor will ask for

Acceptable Use Policy and Removable Media Policy with explicit unknown-media prohibition
Security awareness training materials covering USB drop attacks
Training attendance record showing all employees completed USB security awareness
Removable Media Register showing all authorized USB devices have identified owners

Does AI prompt monitoring help with this control? Honestly, no.

MP.2.125 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →