History

Purpose

This Policy limits the risk that comes with removable media, such as USB sticks, external drives, and memory cards, which are easy to lose and easy to use to carry malware or to remove data without notice.

Scope

This Policy applies to all employees, contractors, and interns of Tidewell IT and to every company laptop, workstation, and server, in the office and in the data centres. It is kept on file for reference.

Policy statements

Principle

1. Removable media is blocked by default on all company devices. The block is enforced by the endpoint settings and cannot be lifted by the user.
2. Information is moved between systems through approved services and not through removable media.
3. Staff who need to receive a file from a customer ask the Service Desk for a secure upload link.

Approved media

1. The only exception is an encrypted token that the Service Desk issues for a specific task, to a named person, for a limited time.
2. The Service Desk records every token in the asset inventory with its holder and its return date.
3. Media from outside, including media handed over by a customer or a supplier, is not connected to a company device before the Service Desk has scanned it.

Handling and disposal

1. A token holds only the data that the task needs, and the data is removed when the task ends.
2. A lost token is reported to the Service Desk at once, and its data is treated as exposed until shown otherwise.
3. The Service Desk wipes returned tokens and destroys tokens that can no longer be trusted, and records the disposal.
4. Tokens are counted at every inventory, and a token that cannot be accounted for is reported as an incident.

Roles and responsibilities

The Service Desk Lead owns this Policy and runs the issue of tokens. The ISMS Manager checks that the block stays in force. Every staff member is responsible for the media in their care.

Exceptions

Exceptions are limited to the encrypted tokens described above. Any other use needs a written request to the ISMS Manager that states the reason, the risk, and an end date.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. This Policy is archived and no longer carries open tasks.

This Policy is superseded by the Acceptable Use Policy and the Information Classification and Retention Policy, which now hold its rules.

Related documents

• Acceptable Use Policy
• Information Classification and Retention Policy

Review

This Policy was last reviewed before it was archived. It is not reviewed again unless it is restored.