Does your organization have a policy and technical controls to restrict the use of removable media devices?

Removable media devices (USB drives, external hard drives, SD cards, etc.) can be used to exfiltrate sensitive data from your systems or introduce malware. Restricting their use through both policy and technical means helps prevent data breaches and malware infections. Evidence could include: a documented removable media policy, screenshots of technical controls such as device control software configurations, group policy settings that disable USB ports, or data loss prevention (DLP) tool configurations that monitor and restrict file transfers to removable media.