Removable media
Removable media are storage devices or materials that can be taken out of a system and used to hold or transfer data, such as USB flash drives, memory cards, and external drives.
Portable storage is useful for moving files between systems. It can also carry sensitive data out of an organization or bring untrusted files into one. Those are different problems: controlling what can be copied to a drive is not the same as checking what arrives on it.
A USB device is not necessarily storage
USB describes a connection technology. Keyboards, cameras, and other peripherals can use it too. A device shaped like a flash drive may present itself to the computer as something else.
In a 2020 investigation, SpiderLabs examined a suspicious device mailed with a gift-card offer. The recipient had not connected it. Researchers found that it emulated a keyboard, rather than simply waiting for someone to open a stored file. The case illustrates why “I will plug it in but not open anything” is not a reliable precaution for an unknown device.
Hand an unexpected device to the security team through the approved process. Our unexpected-USB article covers that handoff without requiring employees to investigate the contents.
Check what the control actually covers
Device controls can distinguish installation permissions from access to removable storage. Microsoft’s documentation describes separate controls and device categories; a storage rule should not be assumed to cover every USB peripheral.
For an authorized assessment, agree on the device type and permitted behavior beforehand. The technical follow-on testing article explains why a decision to connect something and a technical execution test require separate scope.