The usage restriction of portable storage devices shall be ensured through an appropriate documented policy and supporting safeguards.
The organisation should technically prohibit the connection of removable media unless strictly necessary; in other instances, the execution of autoruns from such media should be disabled.
Portable storage devices containing system data shall be controlled and protected while in transit and in storage.