In this guide · 8 sections
- 01Why USB drives are a risk for small businesses
- 02Block, allow or control: choosing your USB policy
- 03What CSA's Cyber Essentials mark expects
- 04How to enforce a USB policy on Windows and Mac
- 05Better alternatives to USB sticks
- 06A one-page removable media policy you can adapt
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
For most small offices: block USB storage by default, allow read-only or BitLocker-encrypted drives for staff who genuinely need them, keep antivirus scanning on access, switch off auto-run, and use shared drives or transfer links instead of sticks.
Why USB drives are a risk for small businesses
Removable media covers USB sticks, external hard disks, SD cards and phones connected as storage. The risks run in both directions.
- Data going out: a staff member copies the client database to a stick to work from home, then loses it. If it is not encrypted, anyone who finds it can read it.
- Malware coming in: a drive from a supplier, a conference giveaway or a car park is plugged in and runs or spreads malicious files.
- Leavers: an employee copies files before resigning, and there is no record of what left.
- No backup trail: important files live only on someone's personal drive, not in the company system.
CSA's Cyber Essentials standard lists removable media among the ways malware gets in, alongside email attachments and web pages. Under the PDPA, losing unencrypted personal data on a drive can also be a notifiable breach if it is likely to cause significant harm.
Block, allow or control: choosing your USB policy
There are three realistic positions. Pick one per group of staff, not one for the whole company if needs differ.
| Policy | What it means | Suits |
|---|---|---|
| Block all USB storage | Drives are not usable; keyboards, mice and chargers still work | Front desk, shared PCs, staff who never need drives |
| Read-only | Staff can open files from a drive but cannot copy data onto it | Staff who receive files from clients or vendors on sticks |
| Encrypted drives only | Writing is allowed only to BitLocker-encrypted or company-issued drives | Site engineers, designers, staff working offline |
| Allow all | No restriction | Rarely the right answer once you hold client data |
A sensible default is block for most staff, with a short exception list. Write down who has an exception and why, and review the list when people change roles or leave. Our BYOD and MDM policy guide covers how this fits with personal devices.
What CSA's Cyber Essentials mark expects
The Cyber Essentials mark does not demand a USB ban, but several requirements in the April 2025 second edition touch removable media:
- A.3.4(c): protect business-critical data, including data on personal devices used for work such as laptops, phones and USB devices.
- A.3.4(d): take measures to stop staff and contractors leaking confidential data; the standard gives disabling USB ports as one example, alongside contract clauses.
- A.4.4(b): antivirus must scan files on access, including files from portable USB drives.
- A.6.4(f): auto-run features of non-essential programs must be disabled.
- A.8.4(g): backups kept separately, for example on password-protected USB drives or encrypted external disks.
So the standard expects you to control, scan and encrypt, rather than to ban. Our Cyber Essentials mark checklist covers the other requirements.
How to enforce a USB policy on Windows and Mac
A written rule is a start, but settings on each laptop make it stick. If your laptops are managed with Microsoft Intune (included in Microsoft 365 Business Premium), these are the main controls.
Turn off auto-run and autoplay
Set Windows autoplay off for all drives through Intune or Group Policy, so nothing launches when a drive is connected.
Make sure antivirus scans on access
Microsoft Defender Antivirus scans files on access by default. Check real-time protection is on and cannot be switched off by users.
Block or limit USB storage with device control
Microsoft's device control in Defender for Endpoint, which also applies to Defender for Business, can deny, allow read-only, or allow named devices by vendor and serial number, while keeping keyboards and mice working.
Require BitLocker for writing to drives
Windows can deny write access to removable drives that are not BitLocker-protected. Staff can still read files from a client's stick but can only save to encrypted drives.
Cover Macs too
Defender for Endpoint on macOS can control removable media, including based on encryption state. Without it, Mac controls are limited, so note the gap in your policy.
Watch the logs
Device control events show which drives were blocked or used. Review them monthly or when someone leaves.
For the encryption side, our guide to laptop encryption with BitLocker and FileVault explains how to switch it on and keep recovery keys safe.
Better alternatives to USB sticks
Most USB use in a small office is moving files between people or from home to office. Cloud tools do that with more control and a record of who accessed what.
- Shared drives: OneDrive, SharePoint or Google Drive shared folders for files staff work on together.
- Transfer links with expiry: share a link that expires after a few days, restricted to named people, instead of copying files to a stick for a client.
- Client portals or secure upload links for receiving documents from customers.
- Company-issued encrypted drives for the few cases that need offline storage, such as site visits without internet.
- Proper backups: a backup service rather than a USB drive someone takes home on Fridays.
A one-page removable media policy you can adapt
Keep the written policy short enough that people read it. Cover these points, then explain it in a five-minute team briefing.
Removable media policy points
For retiring old drives, see our guide to old computer and data disposal.
Do it yourself or get help?
If your laptops are already in Intune and you have Defender for Business, setting up device control and BitLocker rules is an afternoon's work plus testing. Without device management, enforcement means visiting each machine, and settings drift over time.
Our Device Encryption & Management package (S$490) enrols laptops in management, turns on BitLocker or FileVault, and applies a USB policy that matches the tiers above. Antivirus & Endpoint Protection Rollout (S$390) makes sure every device scans files on access and reports to one console.
Frequently asked questions
For most staff, yes, block USB storage by default while keeping keyboards, mice and chargers working. Give a short list of staff who genuinely need drives either read-only access or permission to use company-issued encrypted drives. That stops most accidental data loss and malware without getting in the way of real work.
No. CSA's Cyber Essentials mark expects you to protect business-critical data including on USB devices, take measures against data leaks, with disabling USB ports given as one example, scan files from USB drives on access and disable auto-run. Controlling and encrypting drives can meet these points without a complete ban.
Use device control in Microsoft Defender for Endpoint or Defender for Business, configured through Intune, to deny removable storage, allow read-only access or allow specific approved devices. You can also require BitLocker before anything is written to a removable drive. Test on one machine first, because some phones and cameras appear as storage.
They are much safer than unencrypted drives, because a lost encrypted drive cannot be read without the password or key. They are still easy to lose and leave no access record, so use them only when cloud sharing is not possible, keep a list of who holds them, and wipe or destroy them when no longer needed.
Not plug it in. Found or unexpected drives are a known way to deliver malware, because curiosity does the work. Staff should hand it to whoever handles IT, who can dispose of it or check it on an isolated machine. Include this rule in your security awareness briefing.