Industrial Cybersecurity & OT Risk calculator

USB Control Risk Reduction Calculator

Use this calculator to rank removable media risk reduction opportunities in OT. It helps compare USB control improvements such as approved media handling, scanning workflow, transfer stations, logging, and exception review.

What this calculator does

  • Score risk reduction from USB control improvements using removable media impact, exposure, and control weakness.
  • Use it when reviewing removable media policies, approved transfer stations, scanning, and exception handling for OT environments.
  • The result gives a relative score for removable media control risk.

Formula used

  • USB control risk score = removable media impact score × removable media exposure score × USB control weakness score
  • Use the same scoring scale before and after USB control changes to compare reduction.

Inputs explained

  • Removable media impact score: Score consequence if removable media affects production, quality, recipe integrity, engineering workstations, or critical controllers.
  • Removable media exposure score: Score exposure based on frequency of USB use, vendor transfers, offline updates, engineering file movement, and temporary work.
  • USB control weakness score: Score weakness in approved media, scanning, transfer stations, logging, exceptions, and user accountability.

How to use the result

  • Use it to prioritize transfer stations, media scanning, logging, exception review, and awareness work.
  • It is defensive and does not describe how to bypass media controls.

Common questions

  • What is the USB control risk reduction calculator for? It ranks risk tied to removable media use and USB control weakness in OT.
  • What information should I enter? Use impact, exposure, and control weakness scores for the selected area.
  • What does the result tell me? The result helps prioritize removable media control improvements.
  • When is the result only an estimate? It is only an estimate when USB use is not logged or control evidence is incomplete.

Last reviewed 2026-05-12.