Skip to main content
← All controls
AC-4(8) / MP-2 / SI-4(5) NIST SP 800-53 Rev 5

DLP inspects writes to removable media

Demonstrate that the organization's DLP solution actively inspects content being written to removable media and enforces data protection policies before data leaves organizational endpoints.

Description

What this control does

Data Loss Prevention (DLP) systems monitor and inspect all data being written to removable media devices such as USB drives, external hard drives, and optical media in real time. When a user attempts to copy files to removable media, the DLP solution scans the content against configured policies that classify data based on sensitivity labels, patterns (credit cards, SSNs, intellectual property markers), or contextual rules. If prohibited content is detected, the DLP system can block the write operation, quarantine the data, redact sensitive portions, encrypt the transfer, or log the event for review while allowing the transfer under controlled conditions.

Control objective

What auditing this proves

Demonstrate that the organization's DLP solution actively inspects content being written to removable media and enforces data protection policies before data leaves organizational endpoints.

Associated risks

Risks this control addresses

  • Unauthorized exfiltration of sensitive data (trade secrets, customer PII, financial records) via USB drives by malicious insiders
  • Accidental exposure of regulated data (PHI, PCI, export-controlled technical data) when employees copy files to personal removable media
  • Bypass of network-based data controls when attackers or insiders use physical media to avoid logged network transfers
  • Loss of intellectual property through contractor or temporary worker removal of source code or design documents on external drives
  • Compliance violations (GDPR, HIPAA, ITAR) due to unmonitored transfer of regulated information to unencrypted removable media
  • Chain-of-custody gaps where sensitive data leaves the enterprise without audit trail or forensic visibility
  • Malware introduction or data theft via dual-use of removable media that bypasses endpoint detection and response controls

Testing procedure

How an auditor verifies this control

  1. Obtain and review the current DLP policy configuration governing removable media writes, including classification rules, content inspection patterns, and enforcement actions (block, encrypt, alert, quarantine).
  2. Verify DLP agents are deployed and active on a representative sample of endpoint devices (workstations, laptops) across departments with access to sensitive data.
  3. Identify the list of removable media device types (USB mass storage, external HDDs, SD cards) explicitly covered by the DLP inspection policy.
  4. Execute a controlled test by attempting to copy a file containing test sensitive data (mock PII, labeled confidential document) to a USB drive on a monitored endpoint.
  5. Observe whether the DLP system intercepts the write operation in real time and applies the configured policy action (block, prompt, encrypt, or log).
  6. Review DLP event logs and dashboards for the test transaction to confirm detection accuracy, classification applied, user identity, timestamp, file hash, and action taken.
  7. Interview IT security staff to verify the process for tuning DLP rules, handling false positives, and escalating policy violations to incident response.
  8. Cross-reference a sample of recent removable media write events from DLP logs with help desk tickets or security incident records to validate operational effectiveness and review handling of actual violations.
Evidence required DLP policy configuration exports showing removable media inspection rules, data classification patterns, and enforcement actions; screenshots or logs of DLP agent status on sampled endpoints; event logs capturing test file write attempts with detection results, timestamps, user IDs, and applied actions; screenshots of DLP management console showing active policies and real-time alerts; documentation of tuning procedures and escalation workflows for policy violations.
Pass criteria The DLP solution is configured and actively deployed to inspect content written to removable media on representative endpoints, successfully detects and enforces policy on test sensitive data writes, and generates auditable logs with sufficient detail to identify users, data classifications, and actions taken.

Where this control is tested

Audit programs including this control

Removable Media & USB Control

USB drives, SD cards and external SSDs are the easiest exfil and infection vector. A focused control set.

5 controls · v1.0