What it means
Removable media controls for OT govern authorization, sourcing, scanning, transfer, use, custody, sanitization, and evidence for portable storage that crosses trust boundaries.
Why it matters
USB and other media may be necessary for isolated or legacy systems, but they can carry malware, unauthorized tools, sensitive data, and unverified configurations.
Practical focus
- Use organization-owned or explicitly approved media with unique identity, accountable custody, purpose, target, and time window.
- Scan and stage files in controlled transfer stations, validate source and integrity, restrict device use, and rescan or sanitize after work.
- Record transfers, protect sensitive exports, enforce port and device controls where feasible, and provide an emergency exception process.
- Preserve this evidence: Retain media inventory, authorization, custody, scan results, file hashes, source and destination, operator, time, exception, and sanitization record.
- Exercise this failure scenario: A vendor or technician connects unknown media directly to an engineering workstation or controller and introduces malicious or stale files.
Common mistakes
- Using the label Removable Media Controls for OT without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that Removable Media Controls for OT operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A vendor or technician connects unknown media directly to an engineering workstation or controller and introduces malicious or stale files.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: