Which personally owned peripherals can you use with government furnished equipment (GFE)?
You may use a monitor connected through a video-only cable (VGA, DVI, HDMI, or DisplayPort) and a USB or 3.5mm audio headset with microphone. USB flash drives, external hard drives, and most other personal data-carrying peripherals are prohibited on GFE.
The answer
On a government furnished equipment (GFE) system, the only personally owned peripherals generally allowed are a monitor connected by a display cable (VGA, DVI, HDMI, or DisplayPort) and an audio headset with a microphone. The Cyber Awareness Challenge accepts these because they move only video or audio signals, not stored files or executable input that could compromise the machine.
A monitor over VGA or DVI is purely a one-way display connection: no data storage crosses it. Modern HDMI and DisplayPort do carry a small return channel, but for exam purposes they are still treated as display-only devices with no meaningful data-exfiltration path. A headset likewise only plays and captures audio.
Why the other options are wrong
- USB flash drives and external hard drives are prohibited. They are removable storage, the classic vector for both pulling classified data off a system (exfiltration) and pushing malware onto it. The 2008 Agent.btz worm that infiltrated U.S. military networks spread through an infected USB drive, which is why removable media controls became so strict.
- Personal wireless keyboards and mice are risky because they are Human Interface Devices (HID). A malicious or spoofed HID can inject keystrokes, and wireless variants add a sniffable/injectable radio link. A device that presents itself as a keyboard can run commands the user never typed.
- Personal smartphones, tablets, and chargers that draw a USB data connection are also barred, since a phone can act as mass storage or an HID over the same cable that charges it.
The bigger picture
The rule follows one principle: signal-only peripherals are acceptable, data-bearing or input-injecting peripherals are not. GFE is government property configured to a security baseline, and every device you attach expands its attack surface. Display and audio cables cannot store a file or type a command, so they stay within the baseline. Anything that can hold data or emulate a keyboard breaks it.
GFE stands for Government Furnished Equipment — hardware the government issues and controls, as opposed to personal equipment. When unsure, the safe default is to attach nothing personal and use only the peripherals your agency provides.
| Monitor via VGA/DVI/HDMI/DisplayPort | Allowed | Display signal only; no data storage |
| Headset with microphone (USB/3.5mm) | Allowed | Audio in/out only |
| USB flash drive | Prohibited | Removable storage; exfiltration and malware risk |
| External hard drive | Prohibited | Removable storage; large-scale data leak risk |
| Personal wireless keyboard/mouse | Prohibited | HID keystroke-injection and radio sniffing risk |
| Personal smartphone via USB | Prohibited | Acts as mass storage / HID over data cable |
Frequently asked
What does GFE stand for in cyber awareness?
GFE stands for Government Furnished Equipment. It is hardware such as laptops, phones, and accessories issued and controlled by a government agency, configured to a mandatory security baseline that limits what personal devices you may attach.
Can you connect a personal USB drive to government equipment?
No. Personal USB flash drives and external hard drives are prohibited on GFE. Removable storage is a primary path for stealing sensitive data and for introducing malware, which is why DoD policy blocks unauthorized USB media.
Are wireless keyboards allowed with GFE?
Personally owned wireless keyboards are not permitted. They are Human Interface Devices capable of injecting keystrokes, and the wireless link can be sniffed or spoofed, so they fall outside the allowed signal-only peripherals.
Why are personal peripherals a security risk?
Data-bearing peripherals can exfiltrate sensitive files or carry malware, and input devices can silently inject commands. Display and audio cables are exceptions because they transmit only video or sound and cannot store data or type.