What requirement in the Access Control section of the NIST SP 800-171 2nd revision requires limiting the use of USBs on external systems?
The requirement is 3.1.21 from the Access Control section of the SP 800-171.
That requirement is 3.1.21.