AO coverage. Addresses the Shared Media objective: use of portable storage devices is prohibited when the device has no identifiable owner.

What identifiable owner means here. A portable storage device may be used only if it appears in the media inventory with an asset tag and a named custodian. Vendor giveaways, drives found on the floor or in the lot, drives inherited from a departed employee without a custody record, and unlabeled drives in a drawer all fail that test by definition — and we say so in the policy in exactly those words, because 'no identifiable owner' is otherwise interpreted generously by people who need to move a file right now.

Technical enforcement. Because device control allow-lists specific device identifiers, an unowned drive physically cannot mount on a managed endpoint. This is the same mechanism as the removable media practice, and it is what makes the prohibition real rather than aspirational; the policy language alone would not survive a deadline.

The amnesty bin. A drop box in the IT area accepts found or unwanted media with no questions asked and no incident opened for the finder. Contents go to the destruction queue. Telling people they will not get in trouble is what stopped the previous behavior of plugging in a found drive to see whose it was — which is, of course, the entire attack.

Awareness. The annual module covers the drop-attack scenario with the giveaway-stick framing, since that is the version people actually encounter. New hires are told during onboarding that conference swag drives do not work on company equipment and why.

Inventory hygiene. Issued media is asset-tagged, physically labeled with the custodian, and reconciled quarterly. A drive whose custodian has left and whose custody was not transferred is treated as unowned: it is wiped or destroyed, not reassigned informally.

Maintenance. Quarterly inventory reconciliation; annual review of the amnesty bin volume as an awareness signal — a bin that never fills up may mean people are not using it rather than that no drives are being found.

Accepted gap. Personal drives on personal home equipment are outside our technical reach. Policy prohibits placing CUI on any device not in the inventory, remote access is limited to managed endpoints, and data loss prevention blocks the download paths that would make it easy.

• Policy text defining identifiable owner and prohibiting unowned media
• Media inventory with asset tags and named custodians, plus the quarterly reconciliation
• Device control allow-list demonstrating that unlisted devices cannot mount
• Amnesty bin procedure and destruction queue records
• Awareness module content covering the drop-attack scenario