Policy 7230A - Department of Administration

10. Physical Security
These Physical Security Non-Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1) and the Default Security Requirements (ITEC 7230A.
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
10. Physical Security
10.1. Physical Access Control
10.1.1. Control Physical Access (5 sets) (4 sets)
10.2. Physical Environmental Control
10.2.1. Provide Environmental Controls (5 sets) (5 sets)
10.3. Maintain Records
10.1. Physical Access Control
The following are the Non-Mandatory Procedures that support the Physical Access
Control section of the Default Security Requirements:
10.1.1. Control Physical Access
Agencies should implement appropriate physical security controls to manage
and mitigate physical threats to systems:
10.1.1.1 Identify, Authorize and Authenticate Individuals that Require
Physical Access
All individuals that will require physical access to information system
components must be fully identified and authorized prior to any
access being allowed and must be authenticated at the time of
access:
• Identify the roles that require both regular as well as
occasional physical access and identify the individuals that fill
these roles.
• Provide standing authorization and a permanent
authenticator to individuals that require regular access.
• Require individuals that require occasional access to submit a
request that must be approved prior to access being
attempted or allowed.
• Authenticate individuals with regular access requirements
through the use of their assigned permanent authenticator.
• Authenticate individuals with occasional access requirements
through the use of a personal identification mechanism that
includes name, signature and photograph.
34