03 Portable Media Security: HITRUST requirements

What HITRUST 03 portable media security asks for and why it is hard

Portable Media Security is one of the 19 domains HITRUST scores in e1, i1 and r2 reports, and it covers every removable or portable medium that can carry in-scope data. That includes USB drives, external hard drives, backup tapes and disks, optical media, and laptops or other devices that leave the building with data on them. The domain asks how you decide what may be stored on that media, how it is encrypted, how it is handled and tracked, and how it is destroyed or sanitized when it is no longer needed. If your assessment is coming, treat this domain as an inventory and records problem before it is a tooling problem. The risk is simple to describe and hard to contain. Data leaves the environment on a drive nobody logged, copied for a vendor demo, a contractor, or a backup that was never reconciled with the asset list. Once that medium is outside your facilities, the only controls left are the ones you can prove were applied before it left. Assessors test those controls through evidence, so a policy that says media is encrypted is weaker than an encryption record tied to a specific device and a date.

The domain is hard in practice because portable media is easy to create and rarely recorded. A team can copy data to a thumb drive in seconds, and most organizations never wrote a rule for that case or built a process to catch it. The evidence that usually fails is the inventory of media, the approval or justification for each copy, the encryption status of each device, and the disposal certificates that show media was wiped or destroyed. Many teams have some of these records scattered across ticketing systems and shared drives, but not the consistent trail an assessor will sample. Confirm early which media types your in-scope environment actually uses, and which of those a provider's data center handles on your behalf, because that split determines how much of the domain you can inherit and how much you must prove yourself.

Which portable media and teams fall inside the 03 portable media scope

Scope for 03 Portable Media Security is set by where media physically goes, not only by what kind of device it is. The cards below cover the media types that most often get missed and the single placement question that decides how much of the work the organization keeps. Each card names the team that usually needs to confirm its boundary.

Removable drives and external storage

USB drives, external hard drives and memory cards used with in-scope systems are the most common gap in scope lists. Include any device that has ever received or sent in-scope data, including drives used for file transfers, vendor deliveries and demos. IT operations should confirm which ports and device classes are allowed, and the security team should confirm that removable media is inventoried and encrypted before it leaves the office. Ask whether personal drives are ever connected to corporate endpoints.

Backup media and tapes

Backup tapes, removable disk rotations and cartridges sent offsite are portable media even when they never leave the backup team's control. They often sit outside the normal asset register, which makes them easy to omit. Confirm with the operations team who holds each rotation, where it is stored between cycles, and how retired media is destroyed or wiped. Backup media is also a frequent source of data that outlives its retention period.

Laptops and workstations holding in-scope data

Laptops that are carried between sites, taken home or used in the field are portable media in practice, because the disk itself can be removed or copied. The scope question is whether the device stores, caches or can reach in-scope data, not whether it is a laptop. Endpoint and device management teams should confirm disk encryption status and the process for reissuing or retiring devices. Check how lost or stolen devices are reported and how quickly they are wiped.

Media carried between sites

Media moved by staff, couriers or third-party carriers between offices, data centers and partner sites creates custody handoffs that auditors test closely. Records management and the business units that export data often decide what is sent and why, so they belong in the scoping discussion. Document the chain of custody for each movement, the approved carriers and the encryption applied before transit. Confirm whether any courier contract is itself in the third-party assurance scope.

Media inside a provider data center

This placement decision changes the work most. HITRUST's example of inheritance for a cloud provider treats Portable Media Security as highly inheritable for the data center portion, so media that stays inside the provider's facilities can be covered by the provider's own results. Media that moves through offices, couriers or staff homes stays with the customer. Facilities and legal teams should confirm, in writing, where the provider's responsibility starts and ends before scoping begins.

Staff homes and personal devices

Media that staff take home, including personal drives and devices used for work, is the customer's responsibility in every placement model. Ask HR, IT and the business units whether remote work or hybrid schedules move in-scope data outside controlled locations. Confirm whether personal devices are allowed to store or copy data at all, and whether that answer is written into policy and enforced on endpoints.

How a HITRUST assessor tests portable media security

This table compares what an assessor reviews, requests, samples and looks for in the portable media domain, row by row. Read it as the assessor's checklist: each row shows what the organization must be able to produce before fieldwork begins.

Test area	What the assessor does	Evidence to have ready
Policy and procedures	Reads the documented rules for USB drives, external disks, laptops and backup media, then checks they match how staff actually work.	Current media policy, approval rules for removable storage, owner names and the review date.
Media inventory	Compares the list of portable and backup media against asset records and asks how new devices are added or retired.	Inventory export with device type, owner, location and status, plus reconciliation records.
Encryption settings	Inspects configuration on sampled devices and storage to confirm encryption is enabled and keys are controlled.	Screenshots or configuration exports for sampled devices, key custody records and exceptions with approvals.
Sampling of media	Selects a set of devices or media from the inventory and traces each one back to its owner, encryption status and assigned use.	Records for the sampled items, prepared before fieldwork so the assessor can choose from the full population.
Sampling of disposal events	Selects sanitization or destruction events and checks them against certificates, logs and chain-of-custody entries.	Disposal logs, vendor destruction certificates and evidence that sanitization was verified.
Inherited controls	Confirms that media held in a provider's data center is covered by the provider's own assessment results, and that the organization's scope excludes or includes the right items.	Shared responsibility matrix, the provider's relevant report or certification scope, and a documented boundary.
Common findings	Flags gaps where the policy is silent on personal devices, inventories are incomplete, or disposal records do not match devices.	Corrective action plans with owners and dates, and proof of closure for earlier gaps.
Scoring and quality review	Records results against the domain's requirement statements, then HITRUST performs quality assurance before any report is issued. Fieldwork for validated assessments is limited to at most 90 days.	Organized evidence index so the assessor can complete fieldwork within the window. Confirm timing with your External Assessor.

How to implement portable media controls for a HITRUST assessment

This sequence takes portable media from unknown to controlled: every device is registered, handled by data classification, encrypted, issued and returned under record, disposed of with proof, and watched for devices that should not be there. Each step leaves an artifact an assessor can sample.

Inventory all in-scope portable media
Start by listing every removable and portable storage item that can touch in-scope data: USB drives, external disks, laptops with removable storage, and backup tapes or drives. Record the owner, location, device type, and the systems each device connects to. Include media held by staff at home and media that leaves your facilities with couriers or vendors. The output is a media register that you reconcile against endpoint and asset inventories. The step is done when a sample of endpoints and backup locations can be traced to a register entry.
Define handling rules by data classification
Write a standard that states which classes of data may be stored on portable media, which may not, and which need approval first. Tie each rule to the classification scheme your Data Protection & Privacy domain already uses, so a restricted dataset gets stricter treatment than public material. Assign an owner for the standard, approve it through your governance process, and communicate it to staff who handle data. The output is an approved media handling standard with a classification matrix that an assessor can compare against samples of actual use.
Enforce encryption on removable and backup media
Specify the encryption method for each media type, including full-disk encryption for laptops and encrypted volumes for external drives and backup sets. Configure endpoint management to block or restrict unencrypted removable storage where your tooling allows it, and confirm the settings on test devices before rollout. For backups, document the key custody model. Keys should be stored separately from the media they protect and managed under access controls. Open-source key management such as OpenBao can hold and rotate keys for applications, while on-device encryption is handled by the operating system. Confirm with your own platform team which controls each product supports before committing to a design. The output is an encryption standard and configuration evidence from sample devices.
Control who can export data to media
Limit the ability to copy data onto portable media to roles that need it. Restrict write access to removable storage by group, require documented business justification for exceptions, and route data export from business systems through approved channels where possible. Nextcloud's server-side encryption protects file contents on local and external storage, but it does not hide file names or folder structure, so treat sharing and export settings as a separate control. The output is an access matrix for removable storage and an exception log with approver and expiry for each grant.
Record issuance and return of media
Each media item that is issued to a person or vendor should have a checkout record: the item identifier, the recipient, the purpose, the date issued, and the date returned. Track assets in your asset management system, such as GLPI's Assets module, which can record computers, peripherals and other equipment and can be populated automatically by its agent for managed devices. Reconcile returns against the register each cycle, and investigate anything unreturned. The output is a current issuance log and reconciliation records that show media does not drift outside control.
Set disposal and sanitization procedures
Define how each media type is sanitized or destroyed before reuse, resale, or retirement. The method should match the sensitivity of the data it held, and destruction by a third party should be covered by contract and due diligence under your Third-party Assurance domain. Require a disposal record for every item that includes the serial number, method, date, operator, and either a vendor certificate of destruction or an internal sign-off. The output is a disposal procedure and a set of completed disposal records that an assessor can sample against the register.
Monitor for unapproved devices
Detect removable storage that connects to managed endpoints without approval. Wazuh's Syscollector module collects hardware, installed software, and other endpoint inventory data into its indexer and dashboards, which helps you compare what is connected or installed against the register. Set a review cadence, assign a reviewer, and define how alerts are triaged and escalated to Incident Management. Confirm with your platform team which device connection events your agent and rules actually capture before relying on them as evidence. The output is a monitoring procedure, review records, and a log of investigated exceptions.

Which portable media evidence passes review and how to keep it current

An assessor testing 03 Portable Media Security will ask for records that show media is known, protected and destroyed properly, not only for a written policy. The core set is a current media register listing each USB drive, external disk, laptop and backup medium in scope with its owner and location, a written handling and encryption standard that names the approved encryption method, encryption configuration records showing that the setting was applied and checked, sanitization or destruction certificates for media that left service, and exception approvals that state the reason and carry an expiry date. Some of this evidence exists once, such as the standard and the approval of a specific exception. Other evidence has to stay current between assessments, chiefly the register and the disposal log, because a register that was accurate on the day of fieldwork but is out of date a month later will not hold up to sampling.

A sample of recent events usually persuades an assessor more than a policy does. Expect the assessor to pick a handful of media items or disposals from the period under review and ask you to trace each one from the register to the encryption record to the destruction certificate. Before fieldwork, run that trace yourself on several recent items and confirm that every link exists and matches. Where media stays inside a cloud or data center provider, the inherited portion needs the provider's current assessment report, the scope it covers and a shared responsibility record that states who keeps the register and disposal log for the media you still control. Confirm the report's period and scope with the provider, because an out-of-date or narrower report will not cover the items you need to show. Your own records must still cover laptops, USB drives and external storage outside the provider's facilities.

What meeting portable media security costs in money and effort

This table lists each cost component of meeting the 03 Portable Media Security domain, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Use it to shape a written scope and to ask consistent questions of every quote. The main takeaway is that most cost comes from how much media leaves the data center, not from the number of drives alone.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
Encryption tooling or licenses for removable and backup media	Software vendor or open-source project, plus internal or partner setup time	Licenses recur; open-source deployment is one-time build effort with ongoing upkeep	Number of device types and media formats; self-hosted open-source options can remove license spend but not the setup and operating work
Engineering time to build the media inventory and enforcement	Internal platform or endpoint engineers, or an implementation partner under a fixed-scope agreement	One-time build, then recurring upkeep as devices change	Existing MDM or endpoint tooling that already reports removable storage; the fewer systems that report it, the more custom work
Asset register and inventory data	Internal IT asset owners and any inventory platform used	Recurring	How much media moves outside the data center; laptops, external drives and backup tapes each add records to maintain
Disposal services or sanitization tooling	Internal staff, a certified destruction vendor, or sanitization software	Recurring per disposal event	Volume of media retired each year and whether destruction is outsourced or done in-house with records kept
Staff time for registers and exception reviews	Security, IT operations and asset owners	Recurring	Frequency of exception requests and how often the register is reviewed; clear approval paths lower the load
Readiness support	Implementation partner or internal readiness lead, under a written scope	One-time per assessment cycle, plus retainers if ongoing	Gaps found in the first review of media handling; the more evidence already exists, the less preparation is needed
Assessor fees for testing	Authorized HITRUST External Assessor organization, paid by the assessed organization	Recurring at each validated assessment	Scope of the assessed environment and how much portable media is in it; inherited data center controls can reduce what is tested
Inheritance from a provider's data center	Cloud or colocation provider, plus internal time to document the split	One-time documentation, then periodic review	Whether media stays inside the provider's facilities; the customer still controls media outside them such as USB drives and laptops

Which open-source tools can produce portable media evidence

No single open-source tool governs portable media. The useful pattern is to pair encryption of stored files and keys with an inventory of the devices and storage that exist, so an assessor can see what is in scope and how it is protected. Each card below covers one component and what you must confirm before relying on it.

Server-side encryption for file storage

Nextcloud's server-side encryption protects file contents on local and external storage, with keys held on the server. For 03 Portable Media Security, this covers files that leave a managed device only if they are stored in the Nextcloud instance rather than copied to removable drives. File names and folder structure are not encrypted, so confirm that sensitive data does not rely on naming conventions for protection. Confirm where external storage mounts sit and whether copies can be downloaded to unmanaged media.

Key management and rotation

OpenBao's transit secrets engine encrypts and decrypts application data without storing that data, and supports versioned keys with rotation. This matters for portable media because encrypted backup sets and exported data are only as protected as the keys that open them. Confirm which applications call the transit engine, who may request keys, and how rotation is recorded. Keys should remain in your own infrastructure, separate from the media they protect.

Asset register for media and equipment

GLPI's Assets module records computers, monitors, peripherals, printers and other equipment, entered manually or pushed by the GLPI Agent through native inventory since version 10. It can serve as the register of managed equipment against which removable media policy is checked, including who holds each device. It does not track individual USB drives or backup tapes unless you define those assets yourself. Confirm that your procedure records each media item and its custodian.

Endpoint inventory to detect unmanaged devices

Wazuh's Syscollector collects hardware, operating system, installed software, network interfaces, users and groups from each endpoint into the Wazuh indexer, where dashboards show inventory and reports. Comparing this inventory with the GLPI register helps surface devices that are not registered or that carry unexpected USB or storage-related software. Wazuh does not block removable media on its own. Confirm that every in-scope endpoint runs the agent and that you review inventory changes on a set schedule.

Who owns portable media controls and what partners can take on

Your organization owns the portable media controls in the assessed scope. HITRUST scores this domain based on what your workforce actually does with removable media, so the decisions sit with people who can enforce them. Ownership includes the policy itself, the rules for which media may be used and for what, and the people who approve exceptions when a business need falls outside the rule.

Policy ownership: Set and approve the media policy, including which device classes are allowed, who may hold them and what must be encrypted.
Media decisions: Decide which removable media may hold in-scope data, and which systems block or limit it.
Exception approvals: Record, time-limit and approve each exception with a named owner and a stated reason.
Disposal sign-off: Confirm that media leaving service was sanitized or destroyed, and retain the sign-off as evidence.
Inheritance boundaries: If a cloud provider or data center holds media for you, document what that provider covers and what you still control.

Check that each decision has a named owner and a record that an assessor can sample.

Where portable media controls usually fail and how to close each gap

Portable media is the part of 03 Portable Media Security that a provider's data center inheritance does not cover. The gaps below share one root cause: media moves outside the facilities where controls are inherited, and nobody keeps a current record of where it went. Each card names one failure, a practical fix and the evidence an assessor will ask for.

No inventory of media that leaves the data center

Once a USB drive, laptop or external disk leaves the provider's facility, the customer owns its control. Many teams cannot list which devices hold in-scope data or who holds them. Start with a register of removable and portable media linked to asset records, and reconcile it against the endpoint inventory each quarter. Ask whether your asset tool can record media as distinct items, and confirm how it is kept current. The evidence is the register, its update history and a sample reconciliation.

Personal USB devices used with in-scope data

Staff often copy files to personal drives or move data between machines without any record. The fix is a technical and policy boundary: block or restrict removable storage on endpoints that touch in-scope data, and allow only company-issued, encrypted devices where a business need exists. Review device connection events in your logging platform. The evidence is the endpoint policy setting, the exception list and a sample of connection logs showing blocked or approved events.

Backup media with no encryption record

Backup tapes, external disks and replicated copies often leave the primary environment without a documented encryption state. An assessor will ask whether each backup copy is encrypted, which key protects it and who can restore it. Record the encryption method, key location and key rotation for every backup target, and keep keys in a managed store with versioning. The evidence is a backup register with encryption status, key rotation records and a restore test that shows the keys work.

Disposal with no certificate or log

Drives and media retired from service can carry in-scope data long after their last use. Teams often wipe devices informally, or send them to a vendor without a record of destruction. Require a disposal ticket for each device, a documented sanitization method and a certificate of destruction from any third party. Link each disposal to the asset record so the register closes. The evidence is the disposal log, the destruction certificates and the matching asset status changes.

Inherited scope assumed without checking

Teams sometimes treat a provider's data center results as covering all media, including laptops and drives the customer handles. HITRUST's inheritance example shows the provider's portion can be highly inheritable while portable media outside its facilities stays with the customer. Obtain the provider's current results, confirm which requirements they cover and document your own controls for the rest. The evidence is a shared responsibility matrix, the provider's current report and a dated review record.

Exceptions that never expire

Permitted exceptions, such as a temporary allowance for a vendor drive or a legacy workflow, often outlive their reason. Each exception should name an owner, a business justification, compensating controls and a review date. Remove or renew it at review, and record the decision. The evidence is the exception register, its approvals, compensating control records and proof that expired exceptions were closed or renewed with fresh approval.

What buyers ask before bringing in help for portable media security

How much effort does portable media security take compared with other HITRUST domains?

Portable media security is usually a narrower domain than endpoint protection or access control, because its scope is limited to removable and portable media. The effort depends on how many people, laptops and external drives handle in-scope data, and on whether media is already encrypted and tracked. Most of the work is policy, inventory and evidence of handling and disposal rather than new technology. HITRUST's e1, i1 and r2 each score the domain as part of the whole assessment, so a weak area here still affects the result. Ask any partner to estimate effort from your actual media population and handling workflows, not from a generic template.

Does a cloud or data center provider's inheritance cover portable media?

Only in part. HITRUST's inheritance example shows Portable Media Security as highly inheritable for the data center portion, since media stays inside the provider's facilities. Media that leaves those facilities, such as USB drives, laptops and external storage used by your staff, remains your responsibility. Review the provider's inheritance documentation and shared responsibility matrix to see exactly which controls transfer and which stay with you. You can read more in the HITRUST blog on inheritance for Oracle Cloud Infrastructure.

What does our team need to give an implementation partner?

A partner needs an accurate picture of where portable media is used and how it is controlled. Prepare a list of approved media types, the groups that use them, the current encryption and handling rules, and any records of issued or retired devices. Include the disposal process for drives and backup media, and sample evidence such as sign-out logs or destruction certificates. Name the owner who approves exceptions. Clear access to the people who run these processes will shorten discovery. Your organization still owns the controls; the partner prepares systems and evidence for review.

Can we handle portable media security in-house without outside help?

Yes, many organizations do, provided they have staff who understand the HITRUST requirements and can keep evidence current. In-house teams usually handle policy ownership and daily operation well, but they may struggle to prepare evidence in the form an assessor expects. Consider whether you have someone who can map controls to evidence, run a readiness review and track gaps before fieldwork. If you bring in help, the scope should be written so that your own staff still owns the controls. Only an Authorized HITRUST External Assessor can perform the validated assessment submitted for certification.

How does the work fit the 90-day fieldwork window and the one-year cycle?

The assessor's validated fieldwork window is at most 90 days for e1, i1 and r2, but that window covers only the assessor's testing. Preparation, evidence collection and remediation happen before it starts and usually take longer. The e1 and i1 certifications last one year, so evidence must stay current for the whole period between assessments. Plan the portable media work as an ongoing process, with periodic checks of inventories, encryption and disposal records, rather than a single push before fieldwork. The exact duration depends on your starting point, so ask a partner to explain how it will sequence the work against your assessment date.

What should a quote for portable media security include?

A quote should follow from a written scope. Ask for the in-scope locations, device and media types, systems covered, and the deliverables, such as policy updates, inventory and evidence packs. It should state which activities the partner performs, which your staff performs, and what is one-time versus recurring, such as periodic reviews or retainer support. Ask how the partner handles changes to scope and whether it will prepare evidence only or also support remediation. Confirm that the partner does not issue assessment reports or certifications, since an independent assessor does that. DeployOpen does not publish a price list, and quotes follow from the written scope.

Which open-source tools help produce evidence for portable media controls?

Tools help most with inventory, encryption and monitoring evidence. Nextcloud's server-side encryption protects file contents on local and external storage with keys kept on the server, though it does not encrypt file names or folder structure, so confirm that limit against your data classification. GLPI's Assets module can record computers, peripherals and other equipment, which supports device tracking. Wazuh's Syscollector collects hardware and installed software from endpoints, which can show what is connected to managed machines. Confirm each tool's fit against your own requirements before relying on it as evidence.

How DeployOpen scopes and prepares portable media evidence

DeployOpen plans, implements and documents the self-hosted open-source platforms that produce portable media evidence inside the client's own infrastructure. The organization owns its controls and the HITRUST assessment, and an Authorized HITRUST External Assessor performs the validated assessment and HITRUST issues any report.

How we scope

Confirm which removable media, external storage and backup media fall inside the assessed environment.
Separate data center media that a provider may cover from portable media the organization still controls.
Record the agreed scope, deliverables and timeline in writing before any work starts, since engagements are fixed-scope.

How we build

Configure encryption of stored files and the key handling behind it, with keys kept on the server where the platform supports that model.
Deploy asset inventory so devices and removable media records are entered manually or pushed by an agent.
Test the configured controls against the requirement statements in scope and fix gaps before the assessor arrives.

How we hand over

Document configurations, procedures for media handling and disposal, and the owners responsible for each control.
Provide evidence packages such as inventory exports, encryption settings and log extracts, mapped to the scoped requirement statements.
Walk the internal team through the evidence so they can answer assessor questions and reproduce results themselves.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, agreed in writing.
Review evidence again when the scope, media practices or the CSF version changes, and confirm the current version with HITRUST.
Confirm with your assessor which evidence format and sampling approach they will accept before preparing final packages.