In September 2025, NIST did something it had never done before: it published guidance dedicated entirely to a single, unglamorous attack vector in industrial environments - the USB flash drive.

NIST Special Publication 1334, Reducing the Cybersecurity Risks of Portable Storage Media in Operational Technology (OT) Environments, is a deliberately short two-page document from NIST's National Cybersecurity Center of Excellence (NCCoE). But don't let the length fool you. Its release is an acknowledgment of a hard truth the industry has been dancing around for two decades: removable media remains one of the most reliable ways to breach an air-gapped industrial network, and most organizations still manage it with nothing more than a policy PDF and a locked drawer.

If you're a CISO, OT security lead, or plant operations manager, this guide translates SP 1334 from a two-page checklist into an implementable program. Let's get into it.

Why removable media is still OT's quietest attack surface

Industrial environments run on vendor maintenance laptops, engineering workstations, and field devices that - by design - were never meant to be connected to the internet. When a Siemens PLC needs a firmware update, or a historian needs logs exported for analysis, the USB drive is often the only bridge. It's also, frequently, the bridge attackers walk across.

The documented incidents are well known to anyone in this field:

• Stuxnet (2010): The worm that famously crossed Iran's air gap did so on USB drives carried by contractors and vendors. Nearly every retrospective on OT security starts here - and nearly every one ends with the observation that little has structurally changed since.

• German steel mill (2014): Germany's Federal Office for Information Security (BSI) reported that attackers used USB-borne malware to reach the plant's business network, pivot to the production network, and manipulate control components to the point that a blast furnace could not be properly shut down, causing massive physical damage.

• TSMC (2018): The world's largest chipmaker lost an estimated $170 million in revenue when WannaCry - introduced through a new tool installed on a single unpatched machine - propagated across its fabrication network.

More recently, Honeywell's USB Threat Report found that 59% of removable media threats detected in industrial facilities carried payloads capable of disrupting operational technology - not just IT systems. And OPSWAT has consistently reported that USB-based malware detections are climbing year over year, a trend driven in part by the return of wormable USB malware families.

So why does the problem persist? Because in OT, USBs aren't a convenience - they're a workaround. They're how engineers patch systems that can't be patched over the network, how vendors load PLC logic during commissioning, how shift teams move historian extracts for analysis. Banning them without replacing the capability stalls production. Ignoring them risks the plant. SP 1334's core insight is that the answer isn't prohibition - it's governed, controlled, technically enforced use.

What NIST SP 1334 actually says (and what it doesn't)

SP 1334 was published in final form on September 30, 2025, following a public comment period that closed in August 2025. It is part of the NCCoE's broader OT Security Series and explicitly builds on three existing NIST publications:

SP 1334 organizes its recommendations into four control domains: procedural, physical, technical, and transport/sanitization. What it deliberately does not do is prescribe specific products, architectures, or vendors. That's where implementation judgment comes in - and where most organizations will need help.

The four control domains of SP 1334, decoded

1. Procedural controls: governance before gadgets

The weakest link in removable media security is rarely the technology - it's the absence of a written, enforced, and audited process. SP 1334 expects organizations to have:

• A formal removable media policy defining who may use USB and other portable storage, for what purposes, and under what approval workflow. "Shop floor use isn't highlighted by users" is precisely the failure mode SP 1334 targets.

• Defined roles and responsibilities - including who approves exceptions, who owns the media inventory, and who responds to a suspected contamination event.

• An accountable media inventory. If you can't account for every authorized drive in your facility today, this control is failing silently.

• Incident response procedures specific to media-borne threats. If your OT IR plan and tabletop exercises don't include a USB contamination scenario, you have a blind spot - one that shows up repeatedly in audit findings.

Reality check: Most organizations have a policy. Far fewer can produce evidence that it was applied - approval records, inventory logs, scan reports. Auditors increasingly ask for the evidence, not the document.

2. Physical controls: the cheapest layer most plants skip

Physical measures limit direct access to both the media and the systems that accept it:

• Secure storage for media (locked cabinets, controlled access)

• Port blockers, epoxy fills, or locked enclosures on unused USB ports

• Physical access control to engineering stations and consoles

• Zone-specific media labeling - a drive used in the DMZ should never physically reach Level 2, let alone Level 1

This domain is inexpensive and immediate. It is also where a surprising number of otherwise mature facilities have gaps - a 2019 SANS survey on OT security found that while most organizations had logical controls on IT endpoints, far fewer had systematically addressed physical USB access on control system consoles.

3. Technical controls: where the real enforcement lives

This is SP 1334's most actionable section, and where its requirements map directly to your tooling stack. The standard expects technical enforcement of:

• Disable unnecessary ports - logically (BIOS, OS, group policy) or physically (port locks, epoxy).

• Restrict devices and file execution through allowlisting - not just "block everything," but "permit only what the business needs."

• Scan media before and after use, using updated malware detection with automatic scanning on insertion.

• Scan from an approved alternate device when media must be used on unsupported/legacy systems - a critical nuance for OT, where many endpoints can't run an agent. A dedicated scanning kiosk or "data diode-adjacent" transfer station is the practical answer here.

• Reformat devices before reusing them on different equipment or environments - cross-environment reuse is a top malware vector.

• Use write-protection when files only need to be read.

• Disable Autorun/AutoPlay everywhere, without exception.

• Encrypt data on portable media using a FIPS-certified algorithm.

• Detect and alert on removable media activity - logging insertion events and data transfers, and feeding those logs to monitoring.

A point worth underscoring for CISOs: standard signature-based antivirus is necessary but not sufficient here. Industrial malware (the Stuxnet family being the canonical example) is often crafted to evade IT-grade tooling. Scanning stations used in OT should include OT-aware detection capability, not just commodity AV - a nuance the Shieldworkz team flagged when the draft was released, and one that survives into the final guidance's emphasis on scanning before and after use on both endpoints and alternate devices.

4. Transport and sanitization controls: closing the loop

The final domain addresses what happens to media between and after uses:

• Files moving between zones should transit trusted mechanisms - scanning stations, secure file transfer gateways, or remote access platforms with inline scanning - rather than hand-carried drives.

• Verify file integrity on transfer (hash validation where possible).

• Sanitize media before reuse across environments, in line with SP 800-88 - and destroy media that has reached end of life, using approved methods.

This is also where organizations should seriously evaluate replacing the USB workflow rather than just securing it. Secure file transfer through hardened remote access platforms - browser-based, policy-governed, with inline malware scanning and full session recording - eliminates the media itself for a large share of maintenance and diagnostics tasks. If you remove the drive from the process, you remove an entire class of risk. SP 1334's own framing ("disable unnecessary ports" + "control file access" + "log everything") is fully realized when the USB is simply out of the picture.

The Shieldworkz implementation roadmap: 90 days to SP 1334 alignment

Here's how we'd sequence this in a real facility. Four phases, roughly 90 days, sized for mid-to-large industrial operations:

Phase 1 - Discover and baseline (Days 1–15)

• Asset and port inventory: Map every USB port across OT assets (HMIs, engineering workstations, PLCs with removable media slots, historian servers). Agentless network discovery tools are essential - you can't scan a Level 1 PLC with an agent.

• Media usage audit: Who is actually moving data on and off the OT network, how often, and why? Interview operators, maintenance leads, and vendors. The honest answer is usually "far more than the policy assumes."

• Baseline detection: Enable insertion-event logging on all managed endpoints to get a real picture of USB activity before you touch any policy.

Phase 2 - Policy and governance (Days 15–30)

• Publish the removable media policy with explicit approval workflows and exception handling.

• Assign ownership: one accountable owner for media inventory, one for the scanning infrastructure, one for IR response.

• Add a USB contamination scenario to your OT incident response plan and schedule a tabletop exercise within the next quarter.

Phase 3 - Technical enforcement (Days 30–75)

• Deploy port controls: physically block or logically disable all non-essential ports.

• Stand up a dedicated media scanning kiosk at the OT/IT boundary - with OT-aware malware detection and automatic scanning on insertion.

• Implement device allowlisting on engineering workstations and maintenance laptops (the highest-risk endpoints, since they physically travel).

• Enforce write-protection and Autorun disablement via configuration management.

• Encrypt all approved media with FIPS-validated encryption; alert on any unencrypted insertion.

Phase 4 - Monitor, measure, improve (Days 75–90+)

• Route all insertion and transfer logs into your OT monitoring/SOC pipeline with alerting on unauthorized events.

• Define KPIs (below) and review them monthly with operations leadership.

• Evaluate workflow substitution for the highest-frequency USB use cases - file transfer gateways and secure remote access platforms can retire a meaningful share of physical media usage outright.

Measuring what matters: KPIs for your removable media program

If you can't measure it, an auditor - or an attacker - will eventually find the gap. Track at minimum:

The five mistakes that sink SP 1334 programs

1. Banning USBs without an alternative. Production finds a workaround - shadow IT, personal drives, smuggled media. Governed substitution beats prohibition, every time.

2. Deploying IT-grade scanning for OT malware. Signature AV alone won't catch targeted industrial malware. OT-aware detection on your scanning infrastructure is non-negotiable.

3. Forgetting the vendor. Third-party maintenance is the classic USB insertion vector (Stuxnet's route). Your scanning workflow must cover contractors, integrators, and OEM field engineers - not just employees.

4. Treating legacy systems as exempt. SP 1334 explicitly anticipates unsupported devices - that's what the "scan from an approved alternate device" control is for. A kiosk at the boundary solves what endpoint agents can't.

5. Stopping at policy. A signed policy with no technical enforcement is a compliance artifact, not a control. The gap between the two is where incidents live.

FAQ: quick answers for the audit committee

1.Is NIST SP 1334 mandatory?

No - NIST SPs are voluntary guidance, not regulation. However, expect it to be folded into compliance expectations over time (NERC CIP environments, defense industrial base CMMC assessments, and cyber insurance underwriting reviews are already converging on media control evidence). Treating SP 1334 as your de facto standard now is the pragmatic move.

2.How does SP 1334 relate to SP 800-82 Rev. 3?

SP 1334 is a focused companion. SP 800-82 Rev. 3 is the comprehensive OT security guide; SP 1334 zooms in on one control area and adds specificity on portable storage.

3.What counts as "portable storage media" under SP 1334?

USB flash drives, external hard drives, CDs/DVDs, and - practically speaking - any device that presents mass-storage capability, including smartphones and some engineering dongles. Write your policy broadly.

4.Does SP 1334 apply to IT environments too?

Its focus is OT, but the control domains (procedural, physical, technical, transport/sanitization) apply cleanly to IT as well. Many organizations will find it efficient to build one media governance framework with OT-specific technical enforcement layered on top.

The bottom line

NIST SP 1334 is only two pages long. But its message to industrial organizations is blunt: unmanaged removable media is an unmanaged risk, and policy alone has never stopped a worm. The facilities that come out ahead will be the ones that treat SP 1334 not as a checklist to file away, but as the minimum viable program - then go further, with technical enforcement, OT-aware detection, and workflow substitution that retires the riskiest uses of physical media altogether.

That's precisely where a purpose-built OT security program earns its budget: not in writing the policy, but in making the secure path the easy path for every operator, vendor, and engineer who touches the plant floor.

How Shieldworkz can help: From OT security assessments and removable media policy design to deployment of scanning kiosks, device allowlisting, port control, and 24×7 OT monitoring - Shieldworkz delivers end-to-end industrial cybersecurity as a single, full-stack engagement. Talk to our team about an SP 1334 readiness assessment for your facility.