12.3.1 The relevant entities shall establish, implement and apply a policy on the management of removable …

Requirement

The relevant entities shall establish, implement and apply a policy on the management of removable storage media and communicate it to their employees and third parties who handle removable storage media at the relevant entities’ premises or other locations where the removable media is connected to the relevant entities’ network and information systems.

Guidance

• Define, document and implement a policy on the management of removable media (105).
• Communicate the policy to employees and third parties who handle removable storage media to ensure that they are aware of the policy.

Examples of evidence

• Documented policy on the management of removable media, including at least the items in point 12.3.2 of the Annex to the regulation.
• User manuals or instructions provided to employees and third parties concerning the correct usage of the removable media.
• Documentation showing that employees and third parties have completed training sessions on the policy or forms or electronic records that employees and third parties have signed to acknowledge they have read and understood the policy.
• Evidence of ongoing awareness campaigns, such as posters, emails or intranet posts, reminding employees about the risks and policies associated with removable media.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• ENISA -