GUIDE · OT AND MANUFACTURING
NIST SP 1334 and moving files without a USB stick
In September 2025 NIST published SP 1334, a two-page guide on reducing the risks of portable storage media in OT. It accepts that USB sticks are still how firmware goes in and logs come out, and lists the controls that should surround them. This page goes through that list and says, control by control, what changes when the file crosses by screen and camera or by a one-way cable instead of on a stick.
Written by Taha Bayar, a biologist working on laboratory data handover. Quotations are from NIST SP 1334 (doi.org/10.6028/NIST.SP.1334). Kionel is not mentioned in it, and nothing here is a statement by NIST.
The controls, one by one
| NIST SP 1334 asks for | With a transfer by Kionel |
|---|---|
| "Enabling logs for traceability (e.g., system and user identity, device serial number, date and time)" | Each transfer leaves a dispatch record signed by the sending device and a receipt signed by the receiving device: file hash, size, work order, declared operator, time. Both sides keep a transfer log that can be exported. There is no device serial number because there is no device. |
| "Hash or checksum verification should be performed when transporting files" | Done on every transfer without anyone having to remember it: the receiver accepts the file only if its SHA-256 equals the one the sender signed. |
| "Encrypting the data stored on portable storage media using a FIPS-certified algorithm" | The file is encrypted with AES-256-GCM before the first code is shown, and nothing is stored on a medium. AES-GCM is a FIPS-approved algorithm; the implementation is the browser's, and Kionel has no FIPS validation of its own. |
| "Disabling unnecessary ports" | Screen-to-camera transfer needs no port on the OT machine, so USB ports can stay disabled or sealed. The one-way cable needs one serial port. |
| "Prohibiting media usage unless expressly authorized. Authorization should be limited to specific personnel and purposes" | A site policy can refuse file types, sizes and transfers without a work order or operator, and a receiver card fixes which device may receive. It does not identify a person: the operator is declared, not authenticated. |
| "Scanning of media before and after use" | Not covered. Kionel does not inspect file content. A file arriving in OT should be scanned on an approved machine before it is sent, as it would be before being copied to a stick. |
| "Restricting devices or file execution through allowlisting solutions" | Not covered. That is a control on the OT machine itself. |
| "Detection of removable media activity by configuring alerts on insertion and data transfer" | No alerts. The transfer log records every file; nothing is pushed to a monitoring system. |
| Purchasing, labelling, storing, write-protecting, reformatting and sanitizing media | No longer applies to these transfers: there is no medium to buy, label, lock away or wipe. It still applies to every stick that remains in use. |
What a stick cannot do, and what this cannot do
A USB stick is a computer's storage, plugged into another computer. It can carry more than the file, it can be reprogrammed, and it remembers what it carried last time. A picture on a screen and a cable with one wire carry the bytes that were sent and nothing else, and they carry them one way.
The other side of that is speed and reach. A screen moves kilobytes a second, so this is for logs, recipes, reports and small updates, not disk images; the one-way serial cable is faster and still not a network. Where cameras are forbidden, the screen route is not available. And the two documents SP 1334 points to for the detail, NIST SP 800-82 and SP 800-53, ask for far more than a file transfer tool can supply.
After a one-way transfer: did it arrive?
SP 1334 asks for logs. On a one-way route the sending side cannot be told that a file arrived, so two logs exist and somebody has to compare them. Kionel's records are signed on both sides, and the verifier compares them: every file the sender signed, with the receiver's verified receipt or without one.
Related: IEC 62443 and file transfer, file transfer for OT, and what Kionel does not protect against.