You cannot ban portable storage devices. Bring them under control.

Removable media is the most direct way into an industrial system. It does not defeat your firewall, your segmentation or your remote-access policy. It walks around all of them, in the pocket of someone with a perfectly good reason to be there.

The reflex is to ban it. The ban fails, and always the same way. The need is real: backups, program transfers, supplier patches, offline analysis. So a ban produces workarounds, and workarounds leave no trace. A control leaves a record.

What works is three layers. The middle one is the one everybody skips.

1: The written rule

A short, specific procedure. What it has to say:

• Use the network first. If a controlled file-transfer path exists, the stick is not the answer. On a mature site, most removable-media use is the symptom of a missing transfer path.
• Approved uses only: backup, file transfer, patching, offline analysis. Not “copying a report to finish at home”.
• Site-supplied media only. No personal drives, no contractor drives. This one rule removes most of the risk, and it is the one that needs the most backing from management, because it costs the site money and makes a contractor’s day a little harder.
• Encrypted where the device allows it, scanned before every use, wiped after the transfer. A stick that is wiped after each transfer has nothing to accumulate.

2: A named owner per area

This layer decides whether the other two survive, and it is nearly always the weakest.

The owner is a person, not a role. “The production manager is responsible” means nobody is. You want one named individual per area who knows which devices exist there, holds them, issues them and takes them back, and who was trained in person, not by e-learning, on why it matters.

Alongside that, every device carries a label with a unique ID, and there is one inventory for the whole site rather than one per department. A stick with no label is not a stick. It is an unknown.

3: Technical enforcement

The point of a technical control is that people no longer have to remember the rule.

• Register every device. Each one has an ID and a record: owner, department, which systems it may touch, where it is kept. Devices that are not registered do not work on OT systems, enforced by device allow-listing where the platform supports it.
• Scan before any device touches an OT system. The usual pattern is a dedicated scanning station running a different anti-malware engine from your production endpoints. You will hear it called a scanning kiosk or a portable inspection device. Several vendors sell one; which one matters far less than having one and making the path through it compulsory.
• Disable USB ports and autorun wherever the process allows. Not everywhere, some machines genuinely need a port, but off by default, with every exception justified.
• Record every significant event: scans, results, transfers, disposal, loss. That record is what turns “we control removable media” from a claim into evidence, and it is exactly what an auditor will ask to see in a NIS2 review or an IEC 62443 assessment.

Two practical points the procedure rarely covers

A scan does not transfer trust. A clean scan at the kiosk tells you the stick was clean at that moment. If it then goes back to a contractor’s laptop and returns the next day, yesterday’s scan means nothing. The flow has to run one way: scan, transfer, wipe. Not scan on Monday and trust it all week. Where the consequence justifies it, a one-way transfer path removes the question altogether.

The contractor problem has a cheap fix. The contractor’s own stick never comes in. The site issues a registered device for the job, the files are scanned onto it, and it is handed back and wiped at the end. It costs the price of a few sticks and closes the most common uncontrolled entry point on most sites. When it is not done, cost is rarely the reason. Nobody owns the issuing process, which brings us back to layer 2.

The measure

One question tells you where you stand: can you name, today, every removable device that touched an OT system in your plant this month, and who was holding it?

If yes, you have a control. If not, you have a procedure, and the difference will only show on the day it matters.