Portable Media USB Policy

Portable Media USB Policy

Authorized B y: Chief Information Security Officer (CISO)

Purpose/Overview

While USB devices and other portable media are often used in the workplace, they are a common carrier of viruses and malware among computers. This also holds true for other types of removable media and storage devices. This policy guides employees to make good decisions regarding the use of all types of removable media in Safire.

Scope

This policy applies to the use of all types of removable media, including USB devices. It is applicable to all of Safire’s employees and contractors accessing Safire’s systems, networks and information, whether from the company’s devices or a personal device that connects to the Safire’s network.

Policy

General Prohibition & Technical Controls

Safire strictly prohibits the general use of USB/Removable media.

• Technical Block: IT will enforce endpoint controls to technically block USB mass storage devices by default.
• Auto-Run: The “Auto-Run” and “Auto-Play” features must be disabled on all workstations to prevent automatic malware execution.
• Personal Media: The connection of personal removable media (BYOD USBs) to Safire systems is strictly prohibited.

Approved Business Use

Removable media may only be used if explicitly pre-approved by the CISO (or designee) for specific use cases, such as:

• Transfer to/from trusted partners where no secure network transfer is reasonably available.
• Firmware/patch updates for air-gapped equipment.
• Incident response and forensic collection.

Request and Chain of Custody

• Issuance: Only Safire-owned media issued by IT may be used.
• Scanning: Before first use and after any connection to a non-Safire system, media must be scanned for malware on a standalone scanning station.
• Tracking: A log must be maintained detailing: User, Device Serial Number, Data Classification, and Check-out/Check-in dates.

Encryption Requirements (FIPS)

• Any CUI or sensitive data stored on portable media must be encrypted using FIPS 140-3 (or 140-2) validated encryption modules.

• The use of non-encrypted USB drives for business data is strictly prohibited.

Sanitization and Disposal

• Sanitization: Prior to disposal or reuse, media must be sanitized in accordance with NIST SP 800-88 (Guidelines for Media Sanitization).
• Disposal: Media that is no longer needed or fails sanitization must be physically destroyed (shredded/disintegrated).

Logging and Monitoring

• Audit Logs: IT will configure operating systems to log all “Plug and Play” events.
• Review: The Security Team will review media usage logs every two (2) weeks to identify and investigate unauthorized connection attempts.

Special Systems and Environments

For manufacturing/OT or lab systems that require portable media for updates or data movement, IT and Compliance will define a documented, repeatable procedure covering:

• Device allow -listing on specified endpoints only
• Offline scanning, encryption, and integrity validation
• Maintenance windows and rollback plans
• Post -use sanitization and logging

Training and Awareness

• Portable media risks and procedures are included in onboarding and annual security awareness training.
• Users approved for media use must complete any required role -specific handling training before receiving media.

Compliance

Compliance Measurement

The policy owner will verify compliance through Endpoint Detection and Response (EDR) reports, log reviews, and physical media inventories. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

Strict compliance with this policy is mandatory. An employee’s failure to comply with this policy puts the organization and its customers at significant risk. Any employee found to have violated this policy (e.g., bypassing USB blocks, using personal drives) shall be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Acceptable Use Policy
• Media Protection Policy
• Mobile Device Management Policy
• NIST SP 800-88
• FIPS 140-3 (or 140-2)

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page