This control ensures that any external media (e.g., USB drives, CDs, portable hard drives) containing diagnostic or testing tools is scanned for malware or malicious code before it is connected to or used on organizational systems—especially those handling Controlled Unclassified Information (CUI).