ASD ISM 1359 Establish and maintain removable media policy
What it says
A removable media usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and uphold a policy for using removable media safely.
Having a policy for using removable media, like USB sticks and external hard drives, helps keep your organisation's data safe. Without clear rules, staff might accidentally introduce viruses or lose important information, which could harm your business and break privacy laws.
Free. Save your status, tasks and notes.
Why it matters
No removable media policy increases the chance of malware via USBs and uncontrolled copying of sensitive data off-network.
How to implement
Managers should draft a policy on removable media usage to outline allowed devices and approved software for managing these devices.
Use simple language to ensure everyone understands what devices can be used and for what purposes.
The IT team should conduct regular training sessions for all staff on the correct usage of removable media.
Use real-life examples and how-to guides to ensure employees know how to use these devices safely and securely.
HR should ensure that new employees receive a copy of the removable media policy during onboarding.
Provide a checklist to confirm they understand and accept this policy as part of their employment conditions.
The IT department should implement technical controls to enforce the policy, such as blocking unapproved devices from connecting to the network.
Use endpoint security software that can automatically detect and block any unapproved devices.
System owners should review and update the removable media policy at least annually.
Set a reminder to assess new technologies and threats, ensuring the policy remains relevant and comprehensive.
Keep it running
Maintain a removable media policy covering approved devices, encryption, scanning, labelling, secure storage, and disposal; review at least annually.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written removable media usage policy: Request the specific document that outlines the rules for using removable media.
Look at
The details of what devices are allowed, who can use them, and what safeguards are in place.
Good evidence
A clearly defined policy with specific rules and procedures dated within the last year.
- Check 2 of 5What an auditor asks for
Ask for
Records of training sessions on removable media usage: Request details or logs of recent training activities.
Look at
Who attended, when it occurred, and what was covered.
Good evidence
Attendance logs and training materials that match the policy requirements.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of new employee onboarding procedures: Request a checklist or induction pack that includes the removable media policy.
Look at
How the policy is communicated to new hires and any acknowledgment forms.
Good evidence
Documented evidence that new employees have received and understood the policy.
- Check 4 of 5What an auditor asks for
Ask for
Technical enforcement reports: Request data or logs that show technical controls are monitoring removable media.
Look at
Whether the system denies access to unauthorised devices.
Good evidence
Up-to-date reports showing active monitoring and no unauthorised device breaches.
- Check 5 of 5What an auditor asks for
Ask for
The latest policy review and update process: Request documentation of policy reviews, including who was involved and what changes were made.
Look at
The frequency of reviews and the decision-making process.
Good evidence
A review document that shows the policy is updated annually with input from different stakeholders.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.1.
ISM-1359 requires an organisation to develop, implement and maintain a topic-specific policy covering removable media usage. Annex A 5.1 requires the organisation to define, approve, publish, communicate, acknowledge and periodically review information security policy and topic-specific policies. Annex A 5.1 sets the overarching policy governance lifecycle that a removable media policy under ISM-1359 would sit within.
This control partially meets A.5.10.
ISM-1359 requires an organisation to develop, implement and maintain a removable media usage policy to manage the risks of using removable storage. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would typically include removable media as an asset class. ISM-1359 is more specific (removable media-focused), while Annex A 5.10 is broader across many asset types and usage scenarios.
This control partially overlaps A.7.7.
ISM-1359 requires an organisation to establish and maintain a removable media usage policy covering safe handling and use of removable storage. Annex A 7.7 requires clear desk and clear screen rules, explicitly including requirements for papers and removable storage media to reduce exposure and loss. The overlap is in governing secure handling of removable media, but Annex A 7.7 is focused on workspace hygiene/enforcement whereas ISM-1359 is broader policy coverage for removable media usage across contexts (e.g. approval, transport, connection and storage rules).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.