Overview

A Removable Media Technology Change Authorization (TCA) is required before removable media is connected to an operational technology (OT) system at a Radian Generation site.

This process helps ensure that removable media is properly reviewed and scanned before it is introduced into the environment.

Examples of removable media include:

• USB flash drives
• External hard drives
• CDs
• DVDs
• Other removable storage devices

If you plan to use removable media to transfer files, install software, perform a firmware update, or upload/download data, a TCA may be required.

Before You Submit Your Request

Before submitting a Removable Media TCA request, make sure you have the following information available:

• Name of the person using the removable media
• Site Name
• Company Name
• Reason for using the removable media
• Date the media will be used
• Media Type
  • USB
  • CD
  • DVD
  • External Hard Disk
• Data Transfer Direction
  • Inbound
  • Outbound
  • Both
• Is the storage device formatted? Yes or No
• Removable Media Make
• Removable Media Serial Number
• Evidence of a completed full antimalware scan

Having this information ready will help prevent delays during the review process.

Step 1: Complete the Approved Removable Media Form

Complete the current approved CIP-003 Radian RemovableMediaLog form.

Make sure all required fields are completed accurately.

Step 2: Perform a Full Antimalware Scan

A full antimalware scan must be completed before the removable media is connected to an OT system.

The scan must be performed on the removable media itself.

A real-time or on-access protection notification is not sufficient by itself. The request must include evidence showing that a full scan was completed.

How to Scan a USB Device Using Microsoft Defender

The following instructions show how to perform a custom scan of a USB device using Microsoft Defender through Windows Security.

How to scan a USB device using Microsoft Defender (Windows Security)

Scan Results

When the scan is complete, save the scan results so they can be attached to your TCA request.

Acceptable evidence may include a scan report, scan results, or other documentation showing:

• The removable media that was scanned
• That a full scan was performed
• The date/time of the scan
• The scan result

Step 3: Submit the Request

After completing the form and performing the required antimalware scan, submit the request through the Radian support portal.

Attach the following to your request:

1. The completed CIP-003 Radian RemovableMediaLog form
2. Evidence of the completed full antimalware scan

Please verify that the information on the form matches the removable media being used.

Step 4: Wait for Review and Approval

After submission, the request will be reviewed by the MSS team.

The review will confirm that:

• The appropriate form was used
• Required information has been provided
• The removable media information is complete
• Full antimalware scan evidence has been provided

You will be notified when the request has been approved or denied.

If additional information or documentation is required, the MSS team may contact you before the request can be approved.

Frequently Asked Questions

Can I connect the USB drive before the TCA is approved?

No. The required TCA process must be completed and approval received before connecting the removable media to the applicable OT system.

Is a real-time antimalware scan enough?

No. A full antimalware scan is required. Evidence of real-time or on-access protection alone does not satisfy the scan requirement.

What types of removable media require a TCA?

Removable media can include USB drives, external hard drives, CDs, DVDs, and other removable storage devices. If you are unsure whether your specific use case requires a TCA, contact the MSS team before connecting the media.

What if I do not have the information required on the form?

Do not submit an incomplete request if the information can be obtained beforehand. If you are unsure what information is required, contact the MSS team or your site support channel for assistance.

Quick Checklist

• ☐ Current CIP-003 Radian RemovableMediaLog form is being used
• ☐ All required fields are completed
• ☐ Media type is identified
• ☐ Transfer direction is identified
• ☐ Media make and serial number are provided
• ☐ Full antimalware scan has been completed
• ☐ Scan results/evidence are attached
• ☐ Request has been submitted through the support portal