Plaese refer below
Device control, as its name suggests, controls what devices can be used on a given computer. So if you want to disallow CD burning by a government security analyst with access to secret documents, you can do so. Symantec Endpoint Encryption (SEE) Device Control allows this to be done by policy, across the organization. Permissions can be set by group or per individual user. SEE Device Control could even have allowed Pfc. Manning to listen to Lady Gaga MP3 files, but prevented him from copying files of any type to the CD
https://www-secure.symantec.com/connect/blogs/stopping-wikileaks-scenario-encryption-device-control-and-endpoint-dlp