Skip to Content
Unclassified

Mission Debrief: Removable Media

Removable Media, PEDs, and Mobile Devices

Removable media include flash media, such as thumb drives, memory sticks, and flash drives; external hard drives; optical discs (such as CDs, DVDs, and Blu-rays); and music players (such as iPods). Other portable electronic devices (PEDs) and mobile computing devices, such as laptops, fitness bands, tablets, smartphones, electronic readers, and Bluetooth devices, have similar features. The same rules and protections apply to both.

Risks Associated with Removable Media

The risks associated with removable media include:

  • Introduction of malicious code
  • Compromise of systems’ confidentiality, availability, and/or integrity
  • Spillage of classified information

Potential consequences:

  • Shutdown of systems
  • Compromise of information, systems, programs, and/or assets
  • Loss of mission
  • Loss of life

Approved and Prohibited Devices

Your organization may severely restrict or prohibit the use of removable media and PEDs. Follow your organization’s policies or contact your security POC with questions.

  • Use only removable media approved by your organization
  • Only use flash media or other removable storage when operationally necessary, owned by your organization, and approved by the appropriate authority in accordance with policy
  • Do not use any personally owned/non-organizational removable media on your organization’s systems
  • Do not use your organization’s removable media on non-organizational/personal systems
  • Never plug unauthorized devices into a government system
  • Be aware that wireless connections to the devices bring increased threats and vulnerabilities
  • Abide by the signed End User License Agreement for mobile devices
  • Understand and follow your organization’s Bring Your Own Approved Device (BYOAD) policy

Appropriate Use of Removable Media

If your organization allows it, use removable media and PEDs appropriately:

  • Do not download data from the classified networks onto removable storage media
  • Encrypt data appropriately and in accordance with its classification or sensitivity level
  • As a best practice, label all removable media regardless of classification or environment and avoid inserting removable media with unknown content into your computer
  • Store according to the appropriate security classification in GSA-approved storage containers
  • Mark all classified and sensitive material correctly
  • Ensure unclassified media in a classified environment is labeled appropriately
  • Label all media containing Privacy Act information, personally identifiable information (PII), or protected health information (PHI) appropriately regardless of environment
  • Follow your organization’s policy for sanitizing, purging, discarding, and destroying removable media
  • Destroy classified removable media in accordance with its classification level

SCIFs and Removable Media

When using removable media in a SCIF:

  • Users must properly identify and disclose removable media with local Configuration/Change Management (CM) Control and Property Management authorities
  • Users shall comply with site CM policies and procedures
  • Media shall display a label inclusive of maximum classification, date of creation, POC, and CM Control Number
Skip to Next Tab
Select Next to continue.
Skip Navigation
Unclassified