ASD ISM 0343 Disabling unnecessary access to removable media
What it says
If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDisable writing to removable media unless it's necessary for business.
This control is about stopping people from saving data onto USB sticks and other removable drives unless it's needed for work. It's important because if this isn't controlled, sensitive information could easily fall into the wrong hands if the device is lost or stolen.
Free. Save your status, tasks and notes.
Why it matters
Allowing write access to removable media enables data exfiltration and malware transfer via USB devices, risking disclosure of sensitive information.
How to implement
IT team should identify all devices that can connect with USB ports and other removable media interfaces.
They can do this by conducting a scan of the organisational systems and create a list of all such devices in use.
Managers should assess which employees actually need to use removable media for their roles.
This can be done by meeting with teams to understand their needs and documenting those who truly need access.
The IT team should use software to restrict USB and other removable media access on company computers.
They can install device access control applications that can turn off or limit writing to removable media devices.
System administrators should explore settings on computers to manually disable USB writing capabilities if software isn't available.
This can be done through adjusting operating system settings or using group policies in a Windows environment.
HR and IT teams should work together to update the company's policy to clearly outline when writing to removable media is acceptable and make staff aware through training sessions.
This ensures everyone understands the rules and why they exist.
Keep it running
Use device access control to block removable media write access (allow read/approved devices only) or disable USB storage interfaces, and review exceptions regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of authorised users and devices allowed to write to removable media: Check the document for names, roles, and justification for access.
Good evidence
Is a tidy document listing specific individuals with legitimate reasons noted.
- Check 2 of 5What an auditor asks for
Look at
The software settings for restrictions on removable media. Good settings show that writing capabilities are disabled by default, with specific exceptions logged.
- Check 3 of 5What an auditor asks for
Ask for
Them about their understanding of the policy on removable media use.
Good evidence
Is that they know who can use removable devices and when it's permissible.
- Check 4 of 5What an auditor asks for
Good evidence
Observation shows staff following protocol with no unauthorised devices being used.
- Check 5 of 5What an auditor asks for
Look at
The attendance and content of the last training conducted on this topic. A satisfactory record will show well-documented sessions with good attendance and relevant content.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-0343 requires organisations to disable write access to removable media where there is no business requirement, using device access controls or by disabling external interfaces. Annex A 5.15 requires organisations to establish and implement access control policies and procedures based on business and security requirements, which would include rules about when removable media write access is permitted. ISM-0343 is a specific technical enforcement instance of the broader access control policy framework described in Annex A 5.15.
This control partially meets A.8.3.
ISM-0343 requires organisations to disable write access to removable media and devices where there is no business requirement, implemented through device access control or disabling interfaces. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, which encompasses controlling who can access and use removable media capabilities. ISM-0343 is a specific subset of Annex A 8.3 focused on removable media write restrictions rather than access restriction in general.
This control partially overlaps A.7.10.
ISM-0343 requires organisations to disable write functionality to removable media unless there is a clear business requirement, reducing the risk of data loss and malware introduction via portable devices. Annex A 7.10 focuses on the secure management of storage media across its lifecycle (acquisition, use, transport, disposal), which includes governance over how removable media is used and controlled. They overlap on controlling removable media use, but Annex A 7.10 is broader lifecycle management while ISM-0343 is a specific technical restriction on writing via device/interface controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.