Media Inspection

Your endpoint protection already does most of this. Write down that you rely on it.

Real-time protection scans a diagnostic utility when it lands on disk and scans removable media on access. State in the maintenance policy that diagnostic and test tools are scanned on download or insertion before they run, and that real-time protection enforces it. This requirement extends the malicious code protection of SI.L2-3.14.2 to the tools maintenance brings in.

The scenario is the vendor's diagnostic utility.

Support sends a tool to collect data from a misbehaving server. Download it, scan it, and verify the hash, the file fingerprint the vendor provides, before it runs on anything in scope. That habit is the whole requirement in practice.

Scan before use, not during.

A scan that runs while the USB drive is already in use on an in-scope system arrives too late for the word before in [a]. Scan on insertion, before files are opened. If removable media arrives from outside regularly, check it on a separate machine before it ever touches an in-scope system.

A finding is an incident.

When a scan flags malicious code on maintenance media, the requirement's discussion routes you to incident handling under IR.L2-3.6.1. Quarantine the media, keep it for analysis, and follow the plan.