Purpose
This Policy limits the risk that comes with removable media, such as USB sticks, external drives, and memory cards, which are easy to lose and easy to use to carry malware or to remove data without notice.
Scope
This Policy applies to all employees, contractors, and interns of Tidewell IT and to every company laptop, workstation, and server, in the office and in the data centres. It is kept on file for reference.
Policy statements
Principle
- Removable media is blocked by default on all company devices. The block is enforced by the endpoint settings and cannot be lifted by the user.
- Information is moved between systems through approved services and not through removable media.
- Staff who need to receive a file from a customer ask the Service Desk for a secure upload link.
Approved media
- The only exception is an encrypted token that the Service Desk issues for a specific task, to a named person, for a limited time.
- The Service Desk records every token in the asset inventory with its holder and its return date.
- Media from outside, including media handed over by a customer or a supplier, is not connected to a company device before the Service Desk has scanned it.
Roles and responsibilities
The Service Desk Lead owns this Policy and runs the issue of tokens. The ISMS Manager checks that the block stays in force. Every staff member is responsible for the media in their care.
Exceptions
Exceptions are limited to the encrypted tokens described above. Any other use needs a written request to the ISMS Manager that states the reason, the risk, and an end date.
Compliance and enforcement
Breaches of this Policy lead to disciplinary measures under the HR process. This Policy is archived and no longer carries open tasks.
This Policy is superseded by the Acceptable Use Policy and the Information Classification and Retention Policy, which now hold its rules.
Related documents
- Acceptable Use Policy
- Information Classification and Retention Policy
Review
This Policy was last reviewed before it was archived. It is not reviewed again unless it is restored.