12.3.2. The policy shall: (a) provide for a technical prohibition of the connection of removable …

(a)

provide for a technical prohibition of the connection of removable media unless there is an organisational reason for their use;

(b)

provide for disabling self-execution from such media and scanning the media for malicious code before they are used on the relevant entities’ systems;

(c)

provide measures for controlling and protecting portable storage devices containing data while in transit and in storage;

(d)

where appropriate, provide measures for the use of cryptographic techniques to protect data on removable storage media.