ASD ISM 0341 Disable automatic execution for removable media
What it says
Automatic execution features for removable media are disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure removable media cannot run programs automatically when inserted.
This control ensures that when you plug in a USB stick or other portable storage device, no programs will run automatically. This is important because harmful software could sneak onto your computer without you knowing, potentially leading to data breaches or other security incidents.
Free. Save your status, tasks and notes.
Why it matters
If removable media can auto-run, malware may execute on insertion without user action, causing compromise of systems, credentials and data.
How to implement
The IT team should configure computers to prevent programs on USB sticks from running automatically.
This can be done by adjusting settings in the computer's operating system to disable the 'AutoRun' and 'AutoPlay' features.
The system administrator should regularly check that these settings are enforced on all devices.
This involves running a scan or using system management tools to confirm the configuration matches the policy.
Managers should inform staff about the change and why it's crucial for security.
They can do this by sending a friendly email or holding a quick team meeting to explain how it helps protect the organisation's information.
The IT team should document the steps taken to disable automatic execution and keep this record up-to-date.
This could involve maintaining a checklist or log that details the configuration settings applied to each type of device.
HR should include guidance on handling removable media during employee onboarding and training.
They can create simple guides or include scenarios in training materials to ensure staff understand the risks and new procedures.
Keep it running
Verify AutoRun/AutoPlay is disabled via policy on all endpoints, and routinely test with removable media to ensure nothing executes on insertion.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The IT configuration policy document: Request the document that outlines the settings for disabling automatic execution of removable media. Check that it includes specific instructions for disabling AutoRun and AutoPlay.
Good evidence
Is that the document clearly shows steps for these specific settings.
- Check 2 of 5What an auditor asks for
Ask for
The IT staff to insert a USB stick into a computer and show that no programs run automatically.
Look at
Confirmation that the device does not prompt any automatic execution.
Good evidence
Outcome is seeing the USB content without any programs starting by themselves.
- Check 3 of 5What an auditor asks for
Ask for
Them how they ensure settings are applied across all devices and how they keep track of this. Check that they know the procedures for checking this setting and maintaining logs.
Good evidence
Is that they can describe both the process and the tools they use.
- Check 4 of 5What an auditor asks for
Ask for
Documentation or emails that were used to inform staff about this control and its importance.
Look at
Clear explanations about why disabling automatic execution is necessary.
Good evidence
Is documents that effectively communicate the risks and new practices.
- Check 5 of 5What an auditor asks for
Good evidence
Result is a detailed report listing compliant devices.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-0341 requires automatic execution features for removable media to be disabled to prevent code running when media is inserted. Annex A 8.9 requires security configurations to be established, implemented, monitored, and reviewed across systems, under which disabling AutoRun/AutoPlay for removable media is a specific configuration item. Annex A 8.9 is broader because it covers configuration management generally, while ISM-0341 is a single prescriptive hardening setting focused on removable media execution.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-AC-ML1.3.
ISM-0341 requires disabling automatic execution features for removable media to stop automatic program launch on insertion. E8-AC-ML1.3 restricts what executables, scripts, and installers can run to an approved set, which mitigates malicious execution even if content is introduced via removable media. They overlap in reducing the likelihood of untrusted code running from removable media, but E8-AC-ML1.3 is broader application execution control while ISM-0341 is specifically about AutoRun/AutoPlay behaviour.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.