This control requires your organization to manage and restrict the use of removable media (e.g., USB drives, external hard drives, SD cards) on systems—especially those that store, process, or transmit Controlled Unclassified Information (CUI). You must establish and enforce policies that determine when and how removable media can be used.