SYS.4.5 Removable Media

All employees MUST be made aware of how to handle removable media in a secure manner. Employees MUST be specifically advised on how to handle removable media to prevent loss and theft and ensure longevity.

An organisation MUST inform its staff that they are not allowed to connect removable media from unknown sources to their systems.

Users MUST immediately report a removable storage device that has been stolen or become a suspected target of tampering. In such reports, users MUST specify the information stored on device in question. There SHOULD be clear reporting paths and contact persons in every organisation for this purpose.

If removable media is used or transported outside a secure area and contains confidential data, it MUST be encrypted using a secure method.

Data MUST be checked for malware before being transferred to removable media. Data from removable media MUST also be scanned for malware before being processed.

A policy on the proper handling of removable media SHOULD be established. The following fundamental aspects SHOULD be taken into account:

• which removable media can be used and by whom
• which data may be stored on removable media
• how data stored on removable media will be protected against unauthorised access, tampering, and loss
• how data on removable media is to be deleted
• whether and how private storage media are allowed to be used
• the external employees or service providers with whom storage media may be exchanged and which security regulations are to be observed
• how storage media are to be sent
• how to prevent the spread of malware via removable media

An organisation SHOULD also specify the conditions in which storage media are to be stored in its security policy. In particular, it SHOULD specify that only authorised users have access to the storage media described. It SHOULD also specify that the respective manufacturers' instructions on handling media should be taken into account.

Regular checks SHOULD be carried out to ensure that the security specifications for handling removable media are still up to date.

There SHOULD be clear written rules on whether, how, and on what occasions removable media may be transported. These SHOULD specify which media may be taken off-site, by whom, and what security safeguards are to be observed.

Management procedures SHOULD be in place for removable media. Storage media SHOULD be labelled in a uniform manner. The storage media management concept in place SHOULD ensure that removable media are handled and stored appropriately and used and transported properly.

Before rewritable media are passed on, reused, or discarded, they SHOULD be erased in an appropriate manner.

Users SHOULD mark storage media to be sent in such a way that the sender and recipient can immediately identify them. The labelling of the media or their packaging SHOULD be unambiguous for the recipient. The labelling of storage media containing sensitive information SHOULD ensure that third parties cannot draw any conclusions regarding the type or contents of the information.

A procedure SHOULD be in place to protect against accidental or intentional alterations and thereby ensure the integrity of confidential information. Procedures designed to prevent such changes SHOULD conform to the current state of the art.

Organisations SHOULD review how confidential information can be adequately protected during shipping. Users SHOULD use secure shipping packaging for data media where tampering is immediately detectable. The sender SHOULD inform all the employees involved of the types of shipping and packaging that are required.

Organisations SHOULD only use removable media that are certified. This certification SHOULD take particular account of a given medium's ability to preserve the integrity of data and any encryption that may be in place.

Organisations SHOULD use dedicated systems such as data locks in which data is transferred from one removable storage device to another and scanned for malware.