ASD ISM 1418 Disable unnecessary removable media access
What it says
If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIf you don't need to use removable devices for work, access to them should be blocked.
Disabling unnecessary access to removable media like USB sticks is important to protect sensitive information. If these devices aren't needed for work, they can be a serious security risk because they can introduce viruses or allow someone to steal data easily.
Free. Save your status, tasks and notes.
Why it matters
If removable media access isn't disabled when unnecessary, malware can be introduced and sensitive data can be copied off-system.
How to implement
System owner should assess the need: Determine if your office staff actually requires the use of USB drives for their daily tasks.
If not, you can move to the next steps of preventing access.
IT team should block USB ports: Use the office's computer management software to disable USB ports on all computers.
This can be done by changing the system settings or installing specific software that controls device access.
Manager should communicate the change: Inform all staff about the policy on USB and external device usage.
Provide clear reasons why it's necessary for security, stressing the protection of customer data and business secrets.
IT team should maintain an allowlist: Identify any users who must still use removable media through their work tasks and create a list of approved devices and users.
Ensure these devices are regularly checked for security issues.
Regularly review by manager and IT team: Both should meet quarterly to review the device access list and staff needs to ensure the policy is still suitable and being followed.
Keep it running
Use device access control to block USB/removable media by default; only enable approved ports/devices when a business need exists.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of approved removable media: Request documentation showing which devices and staff are authorised to use them.
Look at
The list of names and devices, ensuring all entries are current and justified.
- Check 2 of 5What an auditor asks for
Ask for
Records of device management software configuration: Request reports that show how USB ports are disabled across the organisation.
Look at
Details on when settings were last updated and by whom.
Good evidence
Shows recent updates and specific control settings applied.
- Check 3 of 5What an auditor asks for
Ask for
A communication record: Request copies of emails or meeting notes sent to staff about the removable media policy.
Look at
The consistency of the policy description and how it was communicated to all employees. Good communication should be clear and regular.
- Check 4 of 5What an auditor asks for
Ask for
IT logs or records of checks on allowlisted devices: Request evidence of routine checks performed on approved removable media.
Look at
Detailed logs showing regular scans or checks.
Good evidence
Set of records demonstrates regular intervals and no significant security issues.
- Check 5 of 5What an auditor asks for
Ask for
Meeting notes from quarterly reviews: Request the documentation from meetings where managers and IT staff discussed removable media access. Check the meeting frequency and the details of any decisions made or updates to the policy.
Good evidence
Note set provides clear action items and a plan for continued review.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-1418 requires disabling unnecessary removable media and device reading via device access control or disabling external interfaces. Annex A 5.15 requires establishing and implementing access control policies and procedures for physical and logical access to information and associated assets based on business requirements. ISM-1418 is a specific access control rule for a particular asset/interface class (removable media), while Annex A 5.15 is a broader control framework that would include such rules among many others.
This control partially overlaps A.7.10.
ISM-1418 requires organisations to disable reading from removable media and devices where there is no business requirement, using device access control or by disabling external interfaces. Annex A 7.10 requires storage media to be managed across its lifecycle (acquisition, use, transport and disposal) in line with classification and handling requirements, which includes controlling how removable media is used. ISM-1418 is a specific technical prevention measure (disable access), whereas Annex A 7.10 is broader governance and handling across the full media lifecycle (including situations where media use is permitted).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.