6.4.3.1
Secure Portable Media
Portable Media Guidelines
Secure Portable Media – Portable Media Guidelines – Organizations using portable media shall:
a. Have strong asset controls for these devices;
b. Require the use of encryption on all of these devices; and
c. Have processes for the sanitization or destruction of portable media prior to disposal.
-
5.10 Acceptable Use of Information and Other Associated Assets: Define, document, and enforce rules for acceptable use and handling of information assets.
5.11 Return of Assets: All personnel must return organization assets (which were in their possession) upon termination or change in employment.
5.32 Intellectual Property Rights: Implement suitable procedures to safeguard intellectual property rights.
5.33 Protection of Records: Safeguard records against loss, destruction, falsification, unauthorized access, and release.
7.10 Storage Media: Manage storage media throughout their lifecycle, including acquisition, use, transportation, and disposal, following the organization’s classification scheme and handling requirements.
7.14 Secure Disposal or Re-Use of Equipment: Before disposal or reuse, verify equipment with storage media to ensure sensitive data and licensed software have been securely removed or overwritten.
8.10 Information Deletion: Delete information stored in information systems, devices, or any storage media when no longer required.
8.24 Use of Cryptography: Define and implement rules for the efficient use of cryptography, including cryptographic key management.
-
3.1.21 Limit use of portable storage devices on external systems.
3.8.3 Sanitize or destroy system media containing CUI before disposal or release for reuse.
3.8.4 Mark media with necessary CUI markings and distribution limitations.
3.8.5 Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
3.8.7 Control the use of removable media on system components.
3.8.8 Prohibit the use of portable storage devices when such devices have no identifiable owner.
-
3.1.21 Limit use of portable storage devices on external systems.
3.8.3 Sanitize or destroy system media containing CUI before disposal or release for reuse.
3.8.4 Mark media with necessary CUI markings and distribution limitations.
3.8.5 Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
3.8.7 Control the use of removable media on system components.
3.8.8 Prohibit the use of portable storage devices when such devices have no identifiable owner.