MP.L2-3.8.8 requires an organization to prohibit portable storage devices unless each device has an identifiable, accountable owner. A practical Azure implementation uses Microsoft Defender for Endpoint and Intune to restrict removable storage to approved device identifiers, maintain an owner register, and retain policy, event, and review records. This defender usb ownership evidence checklist gives MSSP analysts the enforcement design and evidence package needed to support NIST SP 800-171 Rev. 2 and CMMC 2.0 Level 2 assessments.
What does MP.L2-3.8.8 require an organization to do?
NIST SP 800-171 Rev. 2 practice MP.L2-3.8.8 states that organizations must prohibit the use of portable storage devices when those devices have no identifiable owner. The objective is not merely to know which employee inserted a USB device on a particular date. The organization must be able to trace the physical device itself to an accountable person or business owner responsible for its security and authorized use.
This practice builds on MP.L2-3.8.7, which addresses controlling the use of removable media. A company may permit USB storage for a valid business purpose under MP.L2-3.8.7, but MP.L2-3.8.8 still requires it to reject an otherwise permissible device if the device cannot be tied to an owner.
For an assessor, a defensible implementation answers four questions:
- Which portable storage devices are permitted?
- What unique identifier connects each permitted device to an owner?
- How does the organization technically prevent or detect unregistered devices?
- What records demonstrate the control operated during the assessment period?
Which devices count as portable storage under this control?
Portable storage is a removable system component used to store information. Common examples include USB flash drives, external USB hard drives, SSDs, SD cards, memory cards, and smartphones connected in mass-storage mode. A device does not become acceptable because it is encrypted, company-branded, or physically kept in an office; it must still have an identifiable owner.
Not every USB-connected device is portable storage. USB keyboards, mice, headsets, and docking stations generally fall outside the media-storage scope. However, multifunction devices can require review. For example, a smartphone may be used only for charging in one situation and expose file storage through Media Transfer Protocol in another. Your policy should distinguish approved peripherals from devices capable of storing or transferring CUI.
For SMB customers, avoid defining “owner” as a vague department name such as “Engineering.” Record a named employee or a named custodian role with a responsible manager. If a shared encrypted drive is necessary, assign a primary custodian, backup custodian, asset tag, serial number, approval date, and return or review date.
What evidence proves USB ownership for CMMC Level 2?
An asset inventory alone is insufficient unless it identifies the removable device and its responsible owner. The strongest USB ownership evidence links a unique technical identifier, such as serial number or hardware ID, to a governed approval record and to the device-control policy that permits it.
| Evidence item | What it should show | Typical Azure or operational source |
|---|---|---|
| Portable media register | Serial number, asset tag, owner, manager approval, business purpose, encryption status, issue date, and review date | SharePoint List, Azure-hosted register, ITSM CMDB, or controlled spreadsheet |
| Device-control policy | Default block or restrictive mode for removable storage and approved device identifiers or approved groups | Microsoft Intune Endpoint Security and Microsoft Defender for Endpoint |
| Policy assignment evidence | Assigned Entra ID device groups, included endpoints, deployment status, and configuration timestamps | Intune policy reports and device configuration status |
| Usage and block events | Mounted USB devices, serial numbers where available, endpoint name, user context, and blocked attempts | Microsoft Defender advanced hunting and device timeline |
| Periodic review record | Reconciliation of approved media against current staff, device serials, exceptions, and revoked devices | Ticketing system, compliance workbook, or review attestation |
A Defender event showing that j.smith mounted a drive is useful operational evidence, but it does not independently prove that the drive belongs to j.smith. The ownership register and approval workflow establish accountability; Defender supplies technical evidence that enforcement and monitoring occurred.
How should Defender and Intune enforce approved USB storage?
For Windows endpoints, use Microsoft Defender for Endpoint Device Control with Intune to apply removable-storage access control. The desired design is usually deny by default for removable storage, with narrowly defined allow rules for registered devices or approved device classes. Where operational needs require broader access, use audit mode first, then move to enforcement after the register and exception process are stable.
In Intune, create a Windows 10 and later device-control policy under Endpoint Security. Configure removable storage controls to block unauthorized read, write, execute, or all access as appropriate for the customer’s risk decision. Scope the policy to an Entra ID device group containing managed systems that process CUI, and define approved device identifiers using documented serial numbers, hardware IDs, or instance-path identifiers collected during media enrollment.
Use a separate emergency exception process. The request should identify the device serial number, owner, business purpose, systems involved, required access level, manager approval, and expiration date. Do not create broad “temporary USB access” groups without an expiration and post-use review.
How do you build a defender usb ownership evidence checklist?
The defender usb ownership evidence checklist should combine technical enforcement with a repeatable analyst workflow. It is especially useful for MSSPs because the same control pattern can be adapted to different customers while preserving customer-specific owner records and exception approvals.
- Define approved media: Document whether USB flash drives, encrypted external drives, SD cards, and mobile-device storage are prohibited, allowed by exception, or allowed only when registered.
- Establish ownership fields: Require asset tag, manufacturer, model, serial number, primary owner, manager, business justification, encryption confirmation, approval date, and next review date.
- Register devices before use: Collect identifiers from the device or from a controlled enrollment workstation. Validate that the serial number in the register matches the identifier used in the Intune allow rule.
- Deploy Defender Device Control: Start in audit mode for a defined period, review business impact, then enforce block rules for unapproved removable storage.
- Assign policy to managed endpoints: Confirm all in-scope Windows systems report successful policy deployment. Track exclusions separately and require documented approval for each one.
- Monitor USB activity: Use Defender advanced hunting and device timelines to investigate mounts, denied access, and devices not represented in the register.
- Reconcile monthly or quarterly: Compare the ownership register to HR terminations, lost-media tickets, device-control allow rules, and expiring exceptions.
- Preserve assessor-ready evidence: Export the current policy, policy deployment report, media register, sample event logs, blocked-device investigation tickets, and periodic review approvals.
What does a workable MSSP implementation look like?
Consider a 78-person MSP supporting three small defense-contractor customers. The MSP manages 142 Windows 11 endpoints that may process CUI, all enrolled in Intune and onboarded to Microsoft Defender for Endpoint. The service desk issues encrypted USB drives only after receiving a ticket with customer approval; each drive is entered into a SharePoint register with its serial number, owner, asset tag, and six-month review date.
The MSSP creates an Entra ID group for CUI-capable endpoints and deploys an Intune Device Control policy to that group. The policy blocks removable storage by default, while approved encrypted drives are allowed based on the identifiers documented during issuance. A monthly compliance analyst review compares the approved-device list with the SharePoint register and reviews Defender alerts for attempted mounts of unknown drives.
For a second customer with 34 endpoints, the workflow allows read-only access for a narrowly approved forensic-media set but blocks write and execute access. This reduces malware and data-exfiltration exposure while allowing the customer’s field technicians to retrieve approved diagnostic files. The control decision is documented in the customer’s system security plan and media-handling procedure.
How can analysts find USB mounting events in Microsoft Defender?
Advanced hunting can help analysts identify removable media activity and validate that registered-device controls are functioning. Field availability can vary by Windows version, Defender sensor state, and event type, so validate the returned AdditionalFields values in each tenant before relying on a query for automated reporting.
DeviceEvents
| where ActionType == "UsbDriveMounted"
| extend USBDetails = parse_json(AdditionalFields)
| project Timestamp,
DeviceName,
InitiatingProcessAccountName,
DriveLetter = tostring(USBDetails.DriveLetter),
SerialNumber = tostring(USBDetails.SerialNumber),
Manufacturer = tostring(USBDetails.Manufacturer),
ProductName = tostring(USBDetails.ProductName)
| order by Timestamp desc
Export relevant findings to the customer’s ticketing platform when an unknown device is detected. The analyst should determine whether the device is missing from the ownership register, whether policy enforcement failed, or whether the event reflects an approved exception awaiting record updates. This USB ownership evidence process should produce a closed ticket, not just an alert acknowledgment.
What should the compliance checklist include before an assessment?
- [ ] A written portable-storage policy prohibits use of media with no identifiable owner.
- [ ] The policy cross-references MP.L2-3.8.8 and the related media-use restrictions under MP.L2-3.8.7.
- [ ] A current register identifies each approved device by serial number or equivalent unique identifier.
- [ ] Each registered device has a named owner or accountable custodian and documented business purpose.
- [ ] Encryption requirements and lost-media reporting requirements are documented where portable storage is permitted.
- [ ] Intune Device Control policies restrict unapproved removable storage on all in-scope managed endpoints.
- [ ] Policy deployment reports show successful application or approved remediation for failures.
- [ ] Defender evidence shows USB mount activity, denied attempts, or sampled investigations during the review period.
- [ ] Exceptions have approvals, specific device identifiers, expiration dates, and closure records.
- [ ] The customer has completed and retained a periodic ownership-register reconciliation.
What are the most common questions about USB ownership evidence?
Does an encrypted USB drive automatically meet MP.L2-3.8.8?
No. Encryption protects data confidentiality, but MP.L2-3.8.8 requires an identifiable owner. An encrypted drive with no recorded owner, serial number, or accountability record should still be prohibited.
Can we allow all company-issued USB drives?
Only if “company-issued” is backed by a controlled issuance process that uniquely identifies each drive and assigns it to an owner or custodian. A generic policy allowing every USB device from a manufacturer does not reliably prove ownership.
Does Microsoft Defender for Endpoint know who owns a USB device?
Defender can record endpoint activity and device details, but it does not replace an ownership register. Defender telemetry must be correlated with a CMDB, SharePoint register, ITSM asset record, or comparable authoritative source.
What evidence should we show a CMMC assessor for removable media ownership?
Show the written policy, approved-media register, Intune Device Control configuration and assignments, Defender event samples, exception tickets, and periodic review records. Demonstrate how a serial number found in Defender can be traced to an accountable owner.
What should happen when an employee leaves with an assigned USB drive?
The offboarding workflow should recover the device or mark it lost, remove or revoke its allow rule, update the ownership register, and document the outcome in the termination or asset-recovery ticket.
Next step: Build one reusable Azure evidence collection template for your managed customers, then validate it against a live approved-media record and a Defender USB event before the next compliance review.
