Control Objectives: Physical and environmental protection

Authorize visitors before granting entry to physical areas containing restricted data or restricted information.

Change cipher lock codes every 90 days.

Change cipher lock codes upon authorized personnel status change or termination.

Control physical access to (and within) the facility.

Control physical access to network cables.

Control the delivery of assets through physical entry points and physical exit points.

Control the removal of assets through physical entry points and physical exit points.

Design the Information Technology facility with a low profile and consideration given to natural disasters and man-made disasters.

Enable network jacks at the patch panel, as necessary.

Encrypt information stored on mobile devices.

Enter the visitor's name, visitor's organization, and acceptable access areas into the visitor log.

Escort uncleared personnel who need to work in or access secure areas.

Escort visitors within the facility, as necessary.

Establish and maintain Information Technology asset removal procedures.

Establish and maintain a Heating Ventilation and Air Conditioning system.

Establish and maintain a facility physical security program.

Establish and maintain a fire prevention and fire suppression standard.

Establish and maintain a guideline for working in a secure area.

Establish and maintain a lock and access mechanism inventory (keys, lock combinations, or key cards) for all physical access control systems.

Establish and maintain a locking screen saver policy.

Establish and maintain a physical clean desk policy.

Establish and maintain a physical security program.

Establish and maintain a visitor access permissions policy.

Establish and maintain a visitor log.

Establish and maintain an environmental control program.

Establish and maintain asset return procedures.

Establish and maintain end user computing device security guidelines.

Establish and maintain facility maintenance procedures.

Establish and maintain identification issuance procedures for identification cards or badges.

Establish and maintain identification mechanism termination procedures.

Establish and maintain identification procedures.

Establish and maintain mobile device security guidelines.

Establish and maintain off-site physical controls for all distributed Information Technology assets.

Establish and maintain on-site logical controls for all distributed Information Technology assets.

Establish and maintain on-site physical controls for all distributed Information Technology assets.

Establish and maintain organizational facility continuity plans.

Establish and maintain physical security controls for distributed Information Technology assets.

Establish and maintain proper container security.

House system components in areas where the physical damage potential is minimized.

Identify and document physical access controls for all physical entry points.

Implement mobile device security guidelines.

Indicate the active use of collaborative computing devices to users physically present at the device.

Inspect items brought into the facility.

Install and maintain Emergency Power Supply shutdown devices or Emergency Power Supply shutdown switches.

Install and maintain a moisture control system as a part of the climate control system.

Install and maintain an environment control monitoring system.

Install and maintain emergency lighting for use in a power failure.

Install and maintain fire protection equipment.

Install and maintain fire suppression systems.

Install and maintain network jacks and outlet boxes.

Install and maintain redundant power supplies for the Information Technology facility.

Install and protect network cabling.

Issue visitor identification badges to all non-employees.

Lock closeable storage containers.

Log the entrance of a staff member to a facility or designated rooms within the facility.

Maintain and review facility access lists of personnel who have been granted authorized entry to (and within) facilities that contain restricted data or restricted information.

Manage access to loading docks, unloading docks, and mail rooms.

Manage visitor identification inside the facility.

Monitor entry through all physical entry points.

Monitor for unauthorized physical access at physical entry points.

Monitor physical entry point alarms.

Monitor restricted areas with motion detectors or Closed-Circuit Television systems.

Physical and environmental protection

Position computer monitors in such a way that unauthorized personnel are prevented from viewing them.

Prohibit the unauthorized remote activation of collaborative computing devices.

Protect distributed Information Technology assets against theft.

Protect physical assets from water damage.

Protect power equipment and power cabling from damage or destruction.

Provide a physical disconnect of collaborative computing devices in a way that supports ease of use.

Require the return of all assets upon notification an individual is terminated.

Retain all records in the visitor log as prescribed by law.

Retain video events according to Records Management procedures.

Retrieve visitor identification badges prior to the exit of a visitor from the facility.

Review facility access lists.

Review physical access logs, as necessary.

Review visitor logs, as necessary.

Secure non issued access mechanisms.

Secure physical entry points with physical access controls or security guards.

Use locks to protect against unauthorized physical access.

Use locks with electronic authentication systems or cipher locks, as necessary.