ASD ISM 1359Establish and Maintain Removable Media Policy
Official control statement
A removable media usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Organisations must create and uphold a policy for using removable media safely.
What this means in practice
Having a policy for using removable media, like USB sticks and external hard drives, helps keep your organisation's data safe. Without clear rules, staff might accidentally introduce viruses or lose important information, which could harm your business and break privacy laws.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2022
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
No removable media policy increases the chance of malware via USBs and uncontrolled copying of sensitive data off-network.
Operational notes
Maintain a removable media policy covering approved devices, encryption, scanning, labelling, secure storage, and disposal; review at least annually.
Implementation tips
- Managers should draft a policy on removable media usage to outline allowed devices and approved software for managing these devices. Use simple language to ensure everyone understands what devices can be used and for what purposes.
- The IT team should conduct regular training sessions for all staff on the correct usage of removable media. Use real-life examples and how-to guides to ensure employees know how to use these devices safely and securely.
- HR should ensure that new employees receive a copy of the removable media policy during onboarding. Provide a checklist to confirm they understand and accept this policy as part of their employment conditions.
- The IT department should implement technical controls to enforce the policy, such as blocking unapproved devices from connecting to the network. Use endpoint security software that can automatically detect and block any unapproved devices.
- System owners should review and update the removable media policy at least annually. Set a reminder to assess new technologies and threats, ensuring the policy remains relevant and comprehensive.
Audit / evidence tips
- AskThe written removable media usage policy: Request the specific document that outlines the rules for using removable mediaLook atThe details of what devices are allowed, who can use them, and what safeguards are in placeGoodA clearly defined policy with specific rules and procedures dated within the last year
- AskRecords of training sessions on removable media usage: Request details or logs of recent training activitiesLook atWho attended, when it occurred, and what was coveredGoodAttendance logs and training materials that match the policy requirements
- AskEvidence of new employee onboarding procedures: Request a checklist or induction pack that includes the removable media policyLook atHow the policy is communicated to new hires and any acknowledgment formsGoodDocumented evidence that new employees have received and understood the policy
- AskTechnical enforcement reports: Request data or logs that show technical controls are monitoring removable mediaLook atWhether the system denies access to unauthorised devicesGoodUp-to-date reports showing active monitoring and no unauthorised device breaches
- AskThe latest policy review and update process: Request documentation of policy reviews, including who was involved and what changes were madeLook atThe frequency of reviews and the decision-making processGoodA review document that shows the policy is updated annually with input from different stakeholders
Cross-framework mappings
How ISM-1359 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| Annex A 5.1 | ISM-1359 requires an organisation to develop, implement and maintain a topic-specific policy covering removable media usage | |
| Annex A 5.10 | ISM-1359 requires an organisation to develop, implement and maintain a removable media usage policy to manage the risks of using removabl... | |
sync_altPartially overlaps(1)expand_less | ||
| Annex A 7.7 | ISM-1359 requires an organisation to establish and maintain a removable media usage policy covering safe handling and use of removable st... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Media
See all Guidelines for media controls, or browse the full ASD ISM library.