What evidence do auditors commonly ask for on 13 Control removable storage media (Very Good)?

Test showing a USB storage device refused on a sample workstation and AutoPlay not triggered on insertion; Device control policy blocking USB mass storage devices, with approved device exceptions; Group policy settings disabling AutoRun and AutoPlay for all drive types; Logs of blocked removable media connection attempts and approvals for exceptions.

What is the most common gap auditors find on 13?

USB storage blocked for write but still readable, allowing malware to be introduced

ASD Strategies to Mitigate Cyber Security Incidents · Preventing Malware Delivery and Execution

`13` Control removable storage media (Very Good)

Control removable storage media and connected devices. Block USB storage devices. Disable AutoRun/AutoPlay.

Source: ASD Strategies to Mitigate Cyber Security Incidents, 13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ASD Strategies to Mitigate Cyber Security Incidents in the compliance library.

artefacts

held by a system

at each review

easy

to go live

Endpoint management (MDM / EDR)

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Group policy settings disabling AutoRun and AutoPlay for all drive types · Endpoint management (MDM / EDR)
Logs of blocked removable media connection attempts and approvals for exceptions · Endpoint management (MDM / EDR)

periodic reviewEvidence produced at each review

Test showing a USB storage device refused on a sample workstation and AutoPlay not triggered on insertion · Endpoint management (MDM / EDR)

governing documentDocuments that govern the control

Device control policy blocking USB mass storage devices, with approved device exceptions · Policy repository / GRC workspace

First move

Automate the pull from your Endpoint management (MDM / EDR). Device compliance report from the MDM (encryption, EDR agent, OS version) on a daily pull.

Common gaps auditors find

USB storage blocked for write but still readable, allowing malware to be introduced
Exception list grown to include large numbers of users with no expiry
Phones and other connected devices able to mount as storage despite the block

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

12 Antivirus software with heuristics (Very Good) · 14 Block spoofed emails (Very Good)