12.3.2 The policy shall: (a) provide for a technical prohibition of the connection of removable media …

Requirement

The policy shall: (a) provide for a technical prohibition of the connection of removable media unless there is an organisational reason for their use; (b) provide for disabling self-execution from such media and scanning the media for malicious code before they are used on the relevant entities’ systems; (c) provide measures for controlling and protecting portable storage devices containing data while in transit and in storage; (d) where appropriate, provide measures for the use of cryptographic techniques to protect data on removable storage media.

Guidance

• Align the policy with the asset classification (section 12.1) and include at least the following:
  • definitions and scope of removable media,
  • authorization requirements,
  • usage guidelines,
  • measures for control and protection of removable media while in storage and in transit;,
  • techniques to protect information on removable storage media and
  • incident response procedures for lost or compromised media.
• Configure network and information systems to disable the autorun feature for all removable media, to prevent the automatic execution of potentially malicious software.
• If connection of removable media is not prohibited for an organisational (business) reason, removable media should be scanned for malicious code, where appropriate, with up-to-date software against malicious code before being connected to the entity’s network and information systems and/or in real time.
• Encrypt sensitive data stored on removable media using strong cryptographic algorithms to protect against unauthorized access
• Use encryption to protect data stored on portable storage devices, ensuring that unauthorized users cannot access the data if the device is lost or stolen.
• Implement physical security measures, where appropriate, such as secure storage locations and tracking logs for portable storage devices.

Examples of evidence

• Configuration settings of endpoint protection software, if any.
• Audit logs that track the use of removable media, including insertion, removal and data transfer activities.
• Reports of incidents involving removable media, if any.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -