Richman Investments
Removable Media
Acceptable Use Policy
Policy statement
It is the goal of Richman Investments to implement the controlled use of removable media devices that transfer information by all users who have access to any means of data within the company.
Objective
This form is an official Richman Investments document pertaining to the establishment of principles and working practices that are to be abided by all users in order for data to be safely stored and transferred by means of a removable device.
The importance of controlling removable media and the objective of this policy is to: 1. Prohibit any unauthorized disclosure of information as may be necessary to company policy. 2. Maintain data integrity. 3. Build network integrity by instilling confidence and trust with data on the network. 4. Keep high standards of security with the use of protected and restricted data. 5. Avoid malicious network intusions. 6. Prevent unintended or malicious harm on the Richman Investments data network.
Applicable Parties
This policy applies to all Richman Investment employees, members, committees, business partners, third party IT services, guests, or anyone who is approved access to the data network, IT hardware resources, or any equipment with means of access to files within Richman Investments.
Removable Devices Defined 1. USB Memory sticks (flash drive) 2. USB or external hard drive 3. Media Card Readers 4. Embedded microchips (smart cards, mobile phone SIM cards) 5. MP3 or Ipod players 6. Cameras 7. Any media device with storage space with means of transfer via Bluetooth, WIFI, or USB cord. 8. Any device with means to record data
Risk Assessment
Richman Investments recognizes the risks associated with users using and accessing data in order to properly conduct assigned tasks, jobs, or conduct official employer business. Information is often shared throughout the network and possibly with external sources or clients. Securing ALL data and ensuring network integrity is of the utmost importance. Any loss of the ability to access data or network interference could have a tremendous impact on the efficient operation of Richman Investments. It is essential for all of the information systems to endure continued operation and that all Integrity, Confidentiality, and Availability of information is maintained at the appropriate level of the needs of Richman Investments.
This policy aims to reduce the following risks: 1. Damage to Richman Investment reputation as a result of misuse or loss of information. 2. Damage to Richman Investment clients or assets as a result of misuse or loss of data. 3. Contamination of networks or equipment through the introduction of a virus, malware, key logging device, spyware, adware, or any malicious subject. 4. Disclosure of restricted or protected data as a result of theft, careless use, or misuse. 5. Potential legal liabilities as a result of theft, careless use, misuse, or loss of data.
Policy Application
Richman Investments prohibits the use of all personal removable media devices. Approval of use may be granted in special business related circumstances or is required and approved under an employee’s job title. The benefits pertaining to the business must be greater than the risks for acceptable use of removable media access to be granted. Access and approval must be granted by the IT department and proper supervisorial signatures must be obtained. A strict time limit will be implemented for all granted waivers pertaining to removable media.
Removable Media Procurement
After access is approved or granted, removable media and software for use on the network must only be of that of the IT department’s outsourced provider. Personnel media devices are prohibited and will call for immediate termination of use with the storage or recording of data of Richman Investments on these devices. The only approved media on the Richman Investment IT network is that that has been: 1. Approved by the IT department 2. Approved by the proper supervisor 3. Is of the IT departments current outsourced provider.
Data Security
Removable media is restricted to the use of only backed up data as it has a reduced risk of loss through corruption. Data copies cannot be altered in anyway and the original copy must remain at the source. Storage media must be stored in the appropriate, safe, and controlled environment to prevent physical risk, loss, or theft. All data for use on a removable media device must be encrypted and transferred on an encrypted network. IT department is to make users aware that data transfer will be logged and documented. Note that each applicable user is responsible for the data at hand with ensuring appropriate security measures are followed. Users are accountable for compromised, corrupted, or loss of data under their control.
Incident Reporting
All applicable users must report suspected or actual malicious activity, security breaches, or threats to the IT department, their supervisor, and the lead of the department to be handled accordingly.
Client or Third Party Access
External contractors, partners, agents, public, or non-employee parties may not have access to removable media on the Richman Investment Network, hardware resources, or any means of data storage without the IT department’s approval and the appropriate department lead signature.
Responsibilities of Authorized Users 1. Removable media must be obtained from the IT department in accordance with proper procedure. 2. All data to be stored on a removable device must be encrypted. 3. Ant-Virus, malware, spyware, and any other applicable software must be installed, up to date, and turned on before data is allowable for storage or transfer and must be present for any removable device insertion. 4. Only data that is backed up is allowed for storage on removable media devices. 5. Only authorized data is allowable for transfer. 6. User is entitled to proper physical care of storage media devices and deemed liable for them including securely destroying media devices as necessary.
Policy Adherences
Any user found in violation of this policy is subject to Richman Investment’s disciplinary procedures. Violation of a criminal offense punishable by law will require further action of prosecution in the U.S. criminal justice system.
Reference Page

Robinson, C. (January 20, 2011) Banning removable media: Sound policy, short-term prescription or operational chasm? GSN: Government security news. Retrieved January 30, 2013, from: http://www.gsnmagazine.com/node/22259
(September 15, 2009) Removable media security policy. Federal Aviation Industry, U.S. Department of Transportation. Retrieved January 30, 2013, from: http://www.faa.gov/documentLibrary/media/Order/1370.111.pdf
(December 12, 2012) Restrict access to removable storage devices. Small Void. Retrieved January 30, 2013, from: http://smallvoid.com/article/winnt- removable-storage.html
Web Accessibility Initive Retrieved January 30, 2013, from: http://www.w3.org/WAI/guid-tech.html