Physical and Environmental Controls Policy

1. Purpose

This policy sets the physical protections that keep information, equipment and people safe from unauthorised entry, theft, damage and environmental hazards. It makes sure that the physical side of security is as deliberate as the technical side, and that the level of protection matches the value of what is kept in each place.

The routines, checklists and logs are in the Physical and Environmental Security Procedure.

2. Scope

• In scope: offices, data centres, server and network rooms, comms cabinets, storage and archive rooms, loading bays, reception areas and any other premises where the Organisation keeps or processes information.
• In scope: equipment, media, documents and supporting utilities such as power, cooling, fire protection and cabling.
• In scope: staff, visitors, contractors, delivery staff and cleaners present on those premises.
• In scope: hosted or co-located space, in which case the provider's controls are assessed against this policy under the Supplier Relationship Management Policy.
• Out of scope: the home and travel arrangements of staff, covered by the Mobile Device and Teleworking Policy, and the physical security of cloud provider data centres, assured through supplier due diligence.

3. Terms and definitions

4. Roles and Responsibilities

5. Physical Control Policy Statements

5.1 Security zones and perimeters

Premises are divided into zones with controls increasing from public areas to the most sensitive rooms. Each zone has a named owner.

5.2 Entry controls and visitors

• Staff and contractors hold individual badges, issued only after identification and approval, and are recovered on exit. Lost badges are reported at once and disabled within [1 hour] of notice.
• Visitors are pre-registered by their host, show photo identity, receive a visibly different badge, are escorted at all times outside public areas, and are signed out on leaving. The visitor log is kept for [12 months].
• Tailgating is prohibited. Staff challenge or report unknown people without a badge.
• Doors to critical zones are never propped open, and emergency exits trigger an alarm when opened.
• Keys and combinations are issued by Facilities on a register, changed when a holder leaves, and master keys are held in a sealed store.

5.3 Working in secure areas

• People work in a secure area only for approved purposes, and are told of the rules for it.
• Photography, recording and the use of personal devices in critical zones are not allowed without permission.
• Vacant secure rooms are locked and inspected at least [daily].
• Third-party staff, such as cleaners and maintenance, enter critical zones only when accompanied or under a recorded work order.

5.4 Deliveries and loading areas

Deliveries are received at a designated point separate from working areas. Items are inspected, logged and moved by Organisation staff to their destination. Incoming equipment is checked for tampering before connection, and unexpected deliveries are not opened until verified.

5.5 Equipment siting and protection

• Equipment is sited to reduce risk from environmental hazards, unauthorised viewing and unauthorised access. Screens that show Confidential information are positioned away from windows and public areas.
• Servers and network equipment are kept in racks that lock, with spare keys controlled.
• Food, drink and smoking are forbidden in server rooms and near critical equipment.
• Portable equipment is fitted with an automatic screen lock and is secured when left in the office.

5.6 Supporting utilities

• Power, cooling, water detection, ventilation and fire suppression are installed and maintained to the supplier's specification and tested on the schedule below.
• Critical systems are protected by uninterruptible power and a generator or equivalent sufficient for [8 hours] or the time required to shut down safely.
• Emergency lighting, emergency power-off switches, and fire exits are marked, kept clear and tested.
• Environmental monitoring raises alerts to a staffed channel on temperature above [27 degrees Celsius], humidity outside [20 to 80 percent], water, smoke and power failure.

5.7 Cabling security

Power and network cables are protected from interception, interference and damage by conduits, locked cabinets or secure floor and ceiling spaces. Power and data cables are separated, unused ports are disabled or blanked, and patching is documented and changed under change control.

5.8 Equipment maintenance

• Equipment is maintained at the intervals the supplier recommends, only by authorised personnel, and records of faults and maintenance are kept.
• Before equipment is sent for repair, sensitive data is removed or the repair is done on site under supervision. Disks that cannot be wiped are retained.
• Equipment is not removed from premises without authorisation, a log entry and, for portable devices, protection against loss.

5.9 Clear desk and clear screen

• Papers, removable media and notes are locked away when a desk is unattended and at the end of the day. Printed Confidential material is collected at once from printers.
• Screens lock automatically after [5 minutes] and staff lock them manually whenever they leave.
• Whiteboards and flip charts are erased after meetings where Confidential matter was written.

5.10 Off-premises equipment and secure disposal

Equipment used outside the premises is covered by the Mobile Device and Teleworking Policy. Equipment and media that leave service are sanitised or destroyed as set out in the Asset Disposal Process, with a certificate or log kept for each.

5.11 Monitoring, alarms and CCTV

• Intruder alarms, door sensors and CCTV cover entry points, critical zones and loading areas, and are monitored or reviewed as the procedure sets out.
• CCTV is used only for security and safety, notices are displayed, and footage is kept for [90 days] and is accessible only to named staff. Its use respects the privacy rights of individuals.
• Alarms are tested [every 3 months] and every alarm is investigated and logged.

5.12 Protection against external threats

Premises have fire detection and suppression, flood and water-leak detection, and arrangements for severe weather, power cuts and civil disturbance. Threats that could stop operations are included in business continuity planning under the Information Security Aspects of Business Continuity Policy.

6. Testing and Inspection Schedule

7. Compliance and monitoring

The Head of Facilities reports [quarterly] to top management on tailgating incidents, alarm responses, test completion and access list reconciliation. Internal audit includes a walk-through of at least one secure area [every 12 months]. Physical security incidents are reported as security incidents under the Information Security Incident Management Policy.

8. Records and evidence

• Badge issue, change and removal records, and quarterly access list reviews: [3 years].
• Visitor logs: [12 months]. CCTV footage: [90 days], or until closure of any incident it relates to.
• Maintenance, test and inspection records for fire, power and cooling: [5 years].
• Key registers, delivery logs and alarm event logs: [12 months].

9. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

10. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

11. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Physical and Environmental Security Procedure
• Access Control Policy
• Asset Disposal Process
• IT Asset Management Policy
• Information Security Aspects of Business Continuity Policy
• Mobile Device and Teleworking Policy