Protect the handoff, then separate the secret
Software can place files behind a password-controlled workflow on compatible systems. It does not secure plaintext staging copies, the password channel or unsupported recipient devices. Use a unique transfer secret and deliver it through a different authenticated channel.
The coordinator protects the approved package, ejects and reconnects the drive, then opens it as a test recipient. A separate staff member sends the secret by an authenticated channel after confirming the auditor’s identity.
Run the control in five steps
- 01Finish and remove plaintext staging copies under policy.
- 02Apply the approved protection method with a unique strong secret.
- 03Eject, reconnect and verify the protected state.
- 04Send the device and secret through separate controlled channels.
- 05Record who tested access and which system was used.
Preserve an accountable audit trail
Record software/version, device, protection time, operator, test workstation, result, recipient identity check and separate secret-delivery channel. Do not log the password itself.
Stop and investigate when
- The password is taped to or emailed with the drive.
- Files remain readable before authentication.
- Only the creator’s workstation has been tested.
State what the control does not prove
Do not equate with hardware-encrypted drives or untested Mac/Android compatibility. Validate the device, recipient environment, secret channel, plaintext residue and recovery workflow separately.
Audit handoff questions
Can I send the password in the same parcel?
No. Separate the device and secret channels so one interception does not disclose both.
Does USB Secure encrypt the entire physical drive?
Do not assume that. Verify the product boundary and use hardware encryption when required.
Sources for this decision
Links support specific control decisions and do not imply endorsement.