+12.3 Removable media policy
---+12.3.1 The relevant entities shall establish, implement and apply a policy on the management of removable …
---+12.3.2 The policy shall: (a) provide for a technical prohibition of the connection of removable media …
---+12.3.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …

12.3 Removable media policy

Mapping to standards and frameworks

ISO standard 27001:2022A.7.7, A.7.10
NIST Cybersecurity Framework v2.0PR.DS-01, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.3.3-01X, REQ-7.3.3-02X, REQ-7.3.3-03X
CEN/TS 18026:2024ISP-02, AM-02, PS-04
BE-CyFun®2023BASIC: PR.DS-3.1
IMPORTANT: ID.GV-1.2, PR.PT-1.1, PR.PT-2.2
ESSENTIAL: PR.DS-1.1, PR.DS-3.4
FI-KybermittariARCHITECTURE-3g, ARCHITECTURE-5g, ARCHITECTURE-6c
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 11d
Cybersecurity Handbook: Part B: 1.5
Self assessment tool: 2.2, 3.11
ENS-Royal Decree 311/2022Annex II: [mp.eq.3] Protection of portable devices, [mp.sI.2] Cryptography,
FR2.8.1-IE/EE
9.5.IE/EE
9.6-IE/EE

1. Prezentare generală

12.3.1 The relevant entities shall establish, implement and apply a policy on the management of removable …

Requirement

The relevant entities shall establish, implement and apply a policy on the management of removable storage media and communicate it to their employees and third parties who handle removable storage media at the relevant entities’ premises or other locations where the removable media is connected to the relevant entities’ network and information systems.

Guidance

  • Define, document and implement a policy on the management of removable media (105).
  • Communicate the policy to employees and third parties who handle removable storage media to ensure that they are aware of the policy.

Examples of evidence

  • Documented policy on the management of removable media, including at least the items in point 12.3.2 of the Annex to the regulation.
  • User manuals or instructions provided to employees and third parties concerning the correct usage of the removable media.
  • Documentation showing that employees and third parties have completed training sessions on the policy or forms or electronic records that employees and third parties have signed to acknowledge they have read and understood the policy.
  • Evidence of ongoing awareness campaigns, such as posters, emails or intranet posts, reminding employees about the risks and policies associated with removable media.
12.3.2 The policy shall: (a) provide for a technical prohibition of the connection of removable media …

Requirement

The policy shall: (a) provide for a technical prohibition of the connection of removable media unless there is an organisational reason for their use; (b) provide for disabling self-execution from such media and scanning the media for malicious code before they are used on the relevant entities’ systems; (c) provide measures for controlling and protecting portable storage devices containing data while in transit and in storage; (d) where appropriate, provide measures for the use of cryptographic techniques to protect data on removable storage media.

Guidance

  • Align the policy with the asset classification (section 12.1) and include at least the following:
    • definitions and scope of removable media,
    • authorization requirements,
    • usage guidelines,
    • measures for control and protection of removable media while in storage and in transit;,
    • techniques to protect information on removable storage media and
    • incident response procedures for lost or compromised media.
  • Configure network and information systems to disable the autorun feature for all removable media, to prevent the automatic execution of potentially malicious software.
  • If connection of removable media is not prohibited for an organisational (business) reason, removable media should be scanned for malicious code, where appropriate, with up-to-date software against malicious code before being connected to the entity’s network and information systems and/or in real time.
  • Encrypt sensitive data stored on removable media using strong cryptographic algorithms to protect against unauthorized access
  • Use encryption to protect data stored on portable storage devices, ensuring that unauthorized users cannot access the data if the device is lost or stolen.
  • Implement physical security measures, where appropriate, such as secure storage locations and tracking logs for portable storage devices.

Examples of evidence

  • Configuration settings of endpoint protection software, if any.
  • Audit logs that track the use of removable media, including insertion, removal and data transfer activities.
  • Reports of incidents involving removable media, if any.
12.3.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …

Requirement

The relevant entities shall review and, where appropriate, update the policy at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

  • Regularly monitor and audit the use of removable media to ensure compliance with the policy.

Examples of evidence

  • Up-to date removable media policy.
  • Records of reviews or history of changes.

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări

Tichete legate

Legături
is related to 12.3. Removable media policy