The National Institute of Standards and Technology's own policies and technical requirements on USB thumb drive security furnish other federal agencies with a de facto set of best practices.