Media Protection Policy

USB and removable media are disabled by default on endpoints that process CUI. Exceptions require ISSO approval and use of company-issued encrypted devices. All portable media must be encrypted with AES-256 and inventoried.

Media leaving organizational control is sanitized per NIST SP 800-88. Certificates of destruction are retained for the life of the contract plus three years.