Policy 7230A - Department of Administration

10. Physical Security
These Physical Security Non-Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1) and the Default Security Requirements (ITEC 7230A.
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
10. Physical Security
10.1. Physical Access Control
10.1.1. Control Physical Access (5 sets) (4 sets)
10.2. Physical Environmental Control
10.2.1. Provide Environmental Controls (5 sets) (5 sets)
10.3. Maintain Records
10.1. Physical Access Control
The following are the Non-Mandatory Baselines that support the Physical Access
Control section of the Default Security Requirements:
10.1.1. Control Physical Access
Physical threats to systems can only be managed by implementing appropriate
physical security controls:
10.1.1.a Roles Requiring Physical Access
• Regular physical access should be provided to only those
individuals that work in facilities that host systems or system
components and that have a regular requirement to physically
access systems:
o Administration staff.
o Operations staff.
• Occasional physical access may be provided to nay individual
so long as sufficient cause can be demonstrated:
o Temporary administrative staff.
o Temporary operations staff.
o Third-party administrative or operations staff.
o Project-specific staff.
10.1.1.b Physical Access Controls
• All facilities that house systems and/or system components
should be secured with doors that have locks.
• Dedicated areas within facilities that house systems and/or
systems components should be secured with doors that have
pick-resistant locks.
• Dedicated areas within facilities that house systems and/or
systems components should make use of access monitoring
solutions.
29