Hi,
Your Application and Device Control (ADC) policy to prevent writing to CDs does not work as expected. You have verified that a similar policy prevents writing to USB drives. Although attempts to read the CD are logged and allowed, attempts to write are not logged and not blocked.
Check following article for more details:
After setting up an Application and Device Control policy to block CD writing, CD writing is not blocked as expected, and write attempt is not logged
http://www.symantec.com/docs/TECH104800