Only authorized users need to keep and use USB Flash Drivers which are used for device onboarding to IEM, to keep the integrity of the data. We recommend that all unused USB ports should be disabled from BIOS settings. Depending on the device type it might be that by default one USB port is always enabled, for those please consider physical USB port lockers.