They should treat USB access as a privileged transfer path with explicit authorization, separate key management, and centralized monitoring. The practical question is not whether USB can be allowed, but under what identity, for which data types, and with what revocation and sanitization controls if the device leaves the controlled environment.
How should teams define USB authority in an air-gapped environment?
USB governance starts by treating removable media as an explicit access path, not a convenience channel. The policy should define who can approve use, which systems may accept media, what classes of data may move, and what evidence is required before a device is trusted. In an air-gapped setting, the decision is about bounded transfer authority, not simple connectivity.
That means the governing model should be narrower than ordinary endpoint policy. Teams should distinguish a device that is allowed to enter the enclave, a device that is allowed to leave it, and a device that is allowed to cross between zones only under review. If those states are not separated, USB becomes an unmanaged bridge rather than a controlled control point.
What controls make USB use defensible?
Defensible USB use depends on three things: explicit authorization, separate key or media handling, and logging that survives the offline environment. Authorization should be tied to role, purpose, and data classification, with short-lived approvals where possible. The media itself should be inventoryable, uniquely identified, and treated as something that can be revoked, quarantined, or destroyed.
For higher-assurance environments, teams should require scanning, content validation, and chain-of-custody steps before a device is accepted. If the enclave contains sensitive or regulated data, the control set should also include encryption for portable media, strong custody rules, and a documented sanitization path for any device that leaves the zone. NIST Cybersecurity Framework 2.0 is useful here because it frames the problem across governance, protection, detection, and recovery rather than as a single endpoint setting.
Teams often underestimate the need to manage removable media like a privileged asset. The practical control question is whether the same authority that grants USB use can also revoke it quickly, prove what moved, and show that the media was sanitized before reuse or disposal.
Where USB governance fails in practice
USB governance usually fails when exceptions become the normal operating model. The most common pattern is permissive use for convenience, followed by poor inventory, weak traceability, and no reliable way to prove whether a device carried malware, unauthorized data, or a stale certificate store into the enclave. In an air-gapped environment, those failures matter more because remote containment and cloud-based telemetry are limited.
Another common failure is treating sanitization as a last step instead of part of the transfer workflow. If a device can be reused without verified wiping, reimaging, or destruction, it can become a durable contamination path. For environments that rely on signed content, trusted transfer stations, or offline update media, access control, device hygiene, and event logging should be aligned to the same standard rather than managed by separate teams in isolation. NIST SP 800-53 Rev 5 Security and Privacy Controls is a strong control reference for the access, audit, integrity, and configuration elements that need to work together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 — Cybersecurity Supply Chain Risk Management | USB transfer governance depends on controlled media handling and trusted transfer paths. |
| PR.AA-05 — Identity Management, Authentication, and Access Control | USB access is an authorization problem because use must be explicit and revocable. | |
| Recommendation — Define approved media workflows and require traceable approvals for every enclave transfer. Restrict USB use to authorized roles, purposes, and systems with documented exceptions. | ||
| NIST SP 800-53 Rev 5 | AC-19 — Access Control for Mobile Devices | Removable media in air-gapped sites needs explicit control over device use and connection. |
| AU-2 — Event Logging | Offline environments still need evidence of who used media and what changed. | |
| MP-6 — Media Sanitization | Reusable USB devices must be sanitized before reuse or disposal to prevent contamination. | |
| Recommendation — Apply mobile-device controls to limit which removable devices may connect to protected systems. Log every approved USB transfer and preserve the records in a centralized review trail. Sanitize or destroy removable media before reissue, offboarding, or disposal. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Air-gapped environments need strong control over external ingress paths, including removable media. |
| Recommendation — Control removable-media ingress and validate files before they enter the enclave. | ||
| ISO/IEC 27001:2022 | A.8.10 — Information deletion | USB media leaving the environment must be sanitised so residual data cannot be recovered. |
| A.8.15 — Logging | USB governance needs auditable evidence of approvals, transfers, and device handling. | |
| Recommendation — Require verified deletion or destruction of media that has held sensitive enclave data. Record and review media-transfer events with enough detail to reconstruct the chain of custody. | ||
Practitioner Guidance
What to prioritize: Start by classifying every USB use case into one of three buckets: allowed transfer, controlled exception, or prohibited. That classification should drive the approval path, logging depth, and sanitization requirement, not the other way around.
What to verify: Before trusting the process, verify that the enclave can answer three questions from evidence alone: who approved the transfer, what device was used, and what happened to the device afterward. If any of those cannot be reconstructed, the governance model is too weak for an air-gapped setting.
Common mistake: Teams often focus on blocking unknown devices while leaving approved devices effectively unmanaged. The stronger posture is to govern the device lifecycle, because a sanctioned USB stick with broad reuse, weak scanning, or no revocation process can be more dangerous than an unknown one.
Practitioner takeaway: The goal is not to eliminate USB outright, but to make every permitted transfer attributable, bounded, and reversible, with media hygiene treated as part of access governance.
Related resources from NHI Mgmt Group
- How should security teams govern non-human identities that have persistent access?
- How should security teams govern non-human identities in cloud environments?
- How should security teams govern API keys used for generative AI access?
- How should security teams govern authentication in air-gapped environments?