What an auditor, or Sekit's evidence engine, asks for.
Local admin and removable-media controls
The rules on who may have administrator rights on their own device and on the use of USB sticks and external drives.
Data loss prevention configuration
The controls that prevent sensitive data from leaving the company without authorisation, and techniques to mask or anonymise data.
From the Sekit evidence catalog
In practice
Leakage risk at SMEs concentrates in two blind spots: sensitive data sitting somewhere nobody catalogued, like a spreadsheet of customer emails on a shared drive, and USB ports left open on every laptop with no technical restriction. Discovery tools that scan endpoints and cloud storage for sensitive patterns catch the first, but many companies never run one and rely on employees to know where confidential files live. The second is cheaper to fix: operating-system controls can block or whitelist removable storage fleet-wide so the no-USB rule does not rest on individual judgment, and that setting should be verified rather than assumed once it is configured.
Common gaps
Nobody has run a discovery scan, so sensitive data sitting in unexpected shared drives or endpoints has never been identified.
USB ports are technically open on every device, so the removable-media policy depends entirely on employees choosing to follow it.
Local administrator rights are granted broadly, so a user can reconfigure USB restrictions or install unapproved data-transfer tools without anyone noticing.
Questions your auditor will ask
Are USB ports and removable media blocked at the operating system level?
Yes, removable storage is blocked or whitelisted through operating-system controls on every managed device, not left to policy alone.
How do you find sensitive data sitting outside its expected location?
Automated discovery tooling scans endpoints, shared drives, and cloud storage for sensitive patterns on a recurring basis.
Who is allowed local administrator rights on their own laptop?
Only a documented, limited group, recorded in the local admin and removable-media control rules and reviewed periodically.
Where regulation demands it
NIS2 12.3 requires a removable media policy, and ENS mp.eq.3 expects portable devices and their storage to carry equivalent protection wherever they travel.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.