Removable media and one-way transfer into isolated networks

An isolated network still exchanges files: firmware updates go in, and log data comes out. Federal guidance treats the two ways in as separate problems. Removable media, such as Universal Serial Bus (USB) drives and optical discs, falls under media use and port controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5. Network transfer must pass through managed interfaces, and a one-way flow device, or data diode, enforces direction in hardware. NIST's SP 1334, dated September 2025, gives two reasons media remains in use: updating firmware for a device in an isolated operational technology (OT) network, and retrieving log data for offsite diagnostics.

Media use and port controls

Control MP-7, Media Use, has two parts. An organization restricts or prohibits the use of the media types it defines, on the systems it defines, using the controls it defines. It also prohibits portable storage devices that have no identifiable owner. The discussion separates MP-7 from MP-2: MP-2 restricts which users may access media, while MP-7 restricts which types of media may be used on a system. It lists ways to do that, including physical cages over external ports, disabling the ability to insert, read, or write, limiting use to approved devices, and prohibiting writeable devices. Enhancement MP-7(2) prohibits sanitization-resistant media, and its examples include solid state drives and USB removable media.

Control SC-41, Port and I/O Device Access, disables or removes connection ports such as USB, Thunderbolt, and Firewire, and input/output devices such as disc drives. The discussion says physically disabling or removing them is the stronger action. NIST's OT overlay in SP 800-82 Revision 3, September 2023, selects MP-7 at the low, moderate, and high baselines.

Boundary protection and one-way flow

Control SC-7, Boundary Protection, requires monitoring and controlling communications at external and key internal managed interfaces, and connecting to external networks only through managed interfaces made up of boundary protection devices. The discussion lists gateways, routers, firewalls, guards, and encrypted tunnels as managed interfaces. Enhancement SC-7(14) protects against unauthorized physical connections, noting that systems at different classification levels may share equipment rooms and cable paths. SC-7(26) prohibits connecting a classified national security system to an external network without a boundary protection device, typically a managed interface or a cross-domain system.

The one-way case sits in a different family. Enhancement AC-4(7), One-Way Flow Mechanisms, enforces one-way information flows through hardware-based flow control mechanisms. The discussion says these are also called a unidirectional network, a unidirectional security gateway, or a data diode, and can stop data leaving a higher impact or classified domain while letting data from a lower impact domain come in.

Data diodes and unidirectional gateways

The NIST glossary, drawing on SP 800-82 Revision 3, defines a data diode as a network appliance or device that allows data to travel only in one direction. A unidirectional gateway is defined as hardware plus software: the hardware is physically unable to send any information back to the source network, and the software replicates databases and emulates protocol servers and devices.

SP 800-82 Revision 3 adds that, unlike a firewall, a data diode cannot be programmed to allow traffic both ways because the hardware is incapable. The direction depends on what is being protected. The OT example lets traffic leave the operational network but not enter it, while the AC-4(7) example lets data enter the classified domain but not leave.

The paper Seven Steps to Effectively Defend Industrial Control Systems, posted by the Cybersecurity and Infrastructure Security Agency (CISA) and drawn from incidents in fiscal years 2014 and 2015, takes the same approach. If one-way communication can do the job, it says to use optical separation, a data diode. For one-way transfer from a secure zone to a less secure one, it suggests approved removable media instead of a network connection.

Scanning media before it enters

SP 800-82 Revision 3 says unauthorized removable media or devices should not be permitted on any node that is part of or connected to OT. Portable devices, including laptops and USB storage, should be scanned for malicious code before they connect. The Seven Steps paper describes a case in which a nuclear asset owner failed to scan media entering a facility, and found a virus when the media was scanned on exit. Because the owner had used logical enclaving, only six systems had to be remediated.

SP 1334 lists technical controls: scan media before and after use, scan from an approved alternate device when the target cannot, disable Autorun, use write protection when files only need to be read, and verify hashes or checksums when transporting files. CISA's Cross-Sector Cybersecurity Performance Goals, Version 2.0, December 2025, asks for antivirus configured to scan removable media automatically.

The draft SP 800-82 Revision 4, open for comment from September 21 to November 30, 2026, describes a scanning kiosk. In its example architecture for an OT management network, a USB scanning kiosk is the mandatory entry point for removable media and engineer laptops, and media that passes may be loaded from a mirrored file transfer server with the same files that passed validation in the demilitarized zone (DMZ).

What to check

• Which media types does the system allow, on which components, and does every portable device have an identifiable owner, as MP-7 requires?
• Are USB and other ports disabled physically, the stronger option under SC-41, or only logically?
• Is a one-way device enforced in hardware, as AC-4(7) requires, or by configurable rules?
• Which direction does the one-way path run, and does that match what the design protects?
• Is media scanned before and after use, from an approved alternate device when the target cannot scan?
• Is there one mandatory entry point for media and laptops, and are file hashes verified on arrival?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations · National Institute of Standards and Technology, September 2020, includes updates as of December 10, 2020
2. 2Data Diode (glossary entry) · National Institute of Standards and Technology, from NIST SP 800-82r3
3. 3unidirectional gateway (glossary entry) · National Institute of Standards and Technology, from NIST SP 800-82r3
4. 4NIST SP 800-82r3, Guide to Operational Technology (OT) Security · National Institute of Standards and Technology, September 2023
5. 5NIST SP 800-82r4 ipd, Guide to Operational Technology (OT) Security (Initial Public Draft) · National Institute of Standards and Technology, September 2026
6. 6NIST SP 1334, Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments · National Cybersecurity Center of Excellence, NIST, September 2025
7. 7Seven Steps to Effectively Defend Industrial Control Systems · Cybersecurity and Infrastructure Security Agency (authored by NCCIC/ICS-CERT)
8. 8Cross-Sector Cybersecurity Performance Goals, Version 2.0 · Cybersecurity and Infrastructure Security Agency, December 2025

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.