What it asks for. Storage media should be managed through their lifecycle of acquisition, use, transport and disposal in line with the organisation's classification scheme and handling requirements.
In practice. The organisation decides where removable media are allowed at all and enforces that technically, for example by blocking USB storage on most endpoints. Approved media holding sensitive information are encrypted, tracked and stored securely. Transport uses trusted couriers or encrypted containers, and disposal uses secure erasure or physical destruction with a certificate when a third party is used. Evidence includes the media handling procedure, device control settings, asset registers for media and destruction certificates.
Common gaps. Media inside returned or recycled equipment, such as disks in printers or leased laptops, is often overlooked. Organisations also tend to lose track of backup tapes and drives once they leave the data centre.