Physical and Environmental Security Procedure

1. Purpose

This procedure sets out the physical measures that protect Organisation information, people and equipment from unauthorised access, theft, damage, interference and environmental hazards. It describes how premises are divided into zones, who may enter them and how, how equipment is sited, powered, maintained, moved, taken off site and disposed of, and how physical security incidents are reported. It implements the Physical and Environmental Controls Policy.

2. Scope

• In scope: all premises owned, leased or shared by the Organisation, including offices, data centres, server rooms, communication rooms, storage areas, reception, loading bays and parking areas where assets are kept.
• In scope: all equipment and media that holds or processes information, supporting utilities and cabling, and employees, contractors, visitors, suppliers and cleaners who enter the premises.
• In scope: homes, vehicles and travel locations to the extent that Organisation equipment or information is kept there.
• Out of scope: physical security of a third-party data centre or cloud provider beyond what the contract and assurance reports cover; these are managed under the Supplier Relationship Management Procedure.

3. Terms and Definitions

4. Roles and Responsibilities

5. Security Zones

Premises are divided into zones. Each zone has a stated purpose, a level of protection, and an owner who approves who may enter. Zone levels determine the controls described in this procedure.

6. Secure Areas

6.1 Physical security perimeter

Each zone has a defined perimeter that is physically sound. The following rules apply to all sites and are verified in the site inspection.

• Perimeter walls, floors, ceilings and doors of Zone 3 and 4 are of solid construction, extend from true floor to true ceiling, and have no gaps where a person can pass.
• External doors, windows at ground level and roof access points have locks or alarms and are protected from forced entry. Fire exit doors are alarmed and open only outwards.
• Reception is staffed [during business hours] and every entrance used by the public is monitored, with access limited to a single controlled route to the office zones.
• Zone 4 rooms have no windows to the outside, or the windows are secured and obscured, and they are not signposted as data rooms.
• Loading bays and delivery areas are separate from work areas. Goods are inspected and recorded before moving to a work area.
• Intruder alarms cover all external entries and Zone 3 and 4; they are armed outside business hours, monitored by a service and tested [quarterly].
• The perimeter is inspected by facilities [monthly] and after any incident; defects are logged and fixed by the target dates in the maintenance plan.

6.2 Physical entry controls

1. Issue credentialsHR confirms joining; the Head of Facilities issues a photo pass after checking identity. Employees receive Zone 1 and 2 access; any other zone needs an access request approved by the area owner (Annexure C). Time target: [2 working days].
2. Wear and usePasses are worn visibly inside the premises, are personal, and never lent. Each person uses their own credential on every controlled door.
3. ChallengeAnyone without a visible pass, or an unknown person in a controlled area, is politely asked to identify themselves, or is reported to security.
4. ReviewArea owners review access lists [quarterly] against HR data. Facilities removes access that is not confirmed.
5. RemoveOn leaving, role change or contract end, access is removed on the same day (immediately for dismissals) and passes and keys are collected. Evidence: leaver checklist.
6. ReportLost passes are reported at once and are blocked within [30 minutes] of the report.

6.2.1 Visitor management

1. Pre-registerThe host registers the visitor in advance with name, organisation, purpose and time. Contractors needing technical areas also need an access ticket.
2. Sign inReception checks photo identification, records the entry in the visitor log (Annexure A), issues a visitor badge showing the date and the word Visitor, and informs the host.
3. BriefThe visitor is told about fire exits, rules for photographs, devices and networks, and confidentiality, and signs the terms where the visit involves Confidential areas.
4. EscortThe host stays with the visitor at all times beyond Zone 1. Visitors do not enter Zone 3 or 4 unless approved by the area owner and then only with an escort.
5. Sign outReception collects the badge, records departure time and closes the entry. Unreturned badges are blocked. Target: log complete the same day.
6. ReviewFacilities reviews the visitor log [monthly] for missing sign-outs, repeat visitors and unescorted movement.

• Visitor Wi-Fi is the guest network only, as in the Network Security Procedure.
• Cleaning, catering and maintenance staff are on a vetted list, wear a pass and work in secure areas only when supervised or at agreed times.
• Delivery staff do not pass the reception or loading bay without an escort.

6.2.2 Technical controls for entry

• The access control system logs every card use; logs are retained for [12 months] and reviewed [monthly] for failed attempts, doors held open and out-of-hours entry.
• Doors to Zone 3 and 4 are set to alarm if held open for longer than [60 seconds].
• Keys to cabinets and rooms are kept in a key register and a locked key cabinet; keys are signed out and back, and the register is reconciled [monthly].
• CCTV covers entries, reception, loading bays and Zone 4; recordings are kept for [90 days], viewed only by authorised staff and, where they identify individuals, handled under the Data Protection and Privacy Procedure.

6.3 Securing offices, rooms and facilities

• Zone 3 and 4 rooms are locked when unoccupied and doors are not propped open.
• Directories, signage and room names do not reveal the location of critical systems.
• Printers and copiers holding documents are placed in controlled areas, with secure print release.
• Confidential meetings take place in rooms where conversation cannot be overheard, and whiteboards are wiped and photographed notes removed at the end.

6.4 Protecting against external and environmental threats

A threat assessment for each site is done [annually], covering fire, flood, earthquake, storms, extreme heat, power failure, civil unrest, theft and sabotage, and the neighbourhood. The results feed the risk register and the BCP and DR Procedure.

• Critical technology rooms are above flood levels and away from water pipes, kitchens, and shared plant where practicable.
• Hazardous or combustible materials and bulk stationery are not stored in server rooms.
• Backup media and copies of recovery documentation are held in a separate site or a fire-rated safe, as in the Backup Management and Retention Procedure.
• Emergency contacts for police, fire, medical, building management and utilities are posted and tested [annually].

6.5 Working in secure areas

• Staff know that a secure area exists only on a need-to-know basis and do not discuss its contents or controls with outsiders.
• No unsupervised work in Zone 4 without a record of purpose and time. No lone working in rooms with hazards unless an alarm or check-in is arranged.
• Vacant secure rooms are locked and checked [daily] by security.
• Photographic, video and audio recording equipment, and personal storage devices, are not brought into Zone 4 unless approved and logged.
• Contractors working in secure areas follow the permit-to-work process: ticket, named person, start and end times, and sign-off by the area owner.

6.6 Fire security and safety

Life safety comes first. Anyone in doubt evacuates, then reports. The Head of Facilities makes sure each site meets applicable fire regulations and local building codes.

1. AlarmOn hearing the alarm or seeing fire, leave the area, closing doors, and use the nearest safe exit. Do not use lifts or collect belongings.
2. RaisePress the nearest call point and call the emergency number if safe to do so.
3. AssembleGo to the assembly point; marshals sweep floors and take attendance using the visitor log and access system.
4. AwaitDo not return until the fire service or the site lead gives clearance.
5. RecoverAfter the event, the Head of Facilities arranges inspection, informs the incident manager and, where critical systems are affected, invokes the BCP and DR Procedure.

7. Equipment

7.1 Equipment siting and protection

• Servers and network equipment are placed in lockable racks within Zone 4. Rack keys or codes are held by named IT staff.
• Workstations and screens are positioned so that screens cannot be read from windows, corridors or public areas; privacy filters are used where this is not possible.
• Equipment is kept away from water, heat and direct sunlight, and temperature and humidity in Zone 4 are kept within [18 to 27 degrees Celsius and 40 to 60 percent humidity] and monitored with alerts.
• Leak detectors are placed under raised floors and near cooling units.
• Eating, drinking and smoking are not allowed near equipment.
• Equipment is tagged and recorded in the asset register on arrival; items without a tag are reported.

7.2 Supporting utilities and cabling

• Power and data cables are separated to prevent interference and are routed in conduit or trays that are not accessible to the public.
• Patch panels and cabinets are locked; ports are labelled and unused ports disabled. Cabling is documented and checked for unauthorised devices at each inspection.
• Alarm outputs from utilities are linked to a monitored console, and incidents are handled under the Incident Management Procedure.

7.3 Equipment maintenance

1. ScheduleIT operations and facilities keep a maintenance calendar following the supplier's recommendations; each item has an owner.
2. AuthoriseMaintenance is performed only by authorised staff or approved suppliers. Remote vendor access is enabled only for the task, as in the Network Security Procedure.
3. PrepareBack up the system and, for off-site repair, remove or encrypt storage media. Where a device holds Restricted data and the drive cannot be removed, the repair is done on site under supervision.
4. Perform and superviseA staff member supervises third-party engineers in secure areas and records the task.
5. CheckAfter maintenance, test the equipment and check for changes in configuration or tampering.
6. RecordEnter details in the maintenance log (Annexure D): date, equipment, supplier, work done, faults found and parts replaced.

7.4 Removal of assets

No equipment, media or paper marked Confidential or Restricted leaves the premises without authority. The asset owner requests removal through the asset movement form (Annexure B) in the ticketing tool.

1. RequestThe requester completes the movement form with item, serial, reason, destination, date out and return.
2. ApproveThe approver in the table signs; security is informed.
3. Check outSecurity guard or reception verifies the item against the form and the asset tag, and records the exit time.
4. TrackThe asset register shows the item as off-site. Facilities chases overdue returns after [2 working days].
5. Check inOn return, security records the item, IT inspects it for damage or tampering, and the register is updated.

• Spot checks of bags and vehicles at exits are made by security where permitted by law and policy, with respect for dignity and with a witness.
• Items found leaving without authority are stopped and reported as a physical security incident.

7.5 Security of equipment and assets off-premises

• Equipment away from the premises is never left unattended in public places, vehicles or hotel rooms. Laptops travel in carry-on luggage, not checked baggage.
• Full-disk encryption, passcode and remote wipe are required for every portable device as in the Mobile Device Management Procedure.
• At home, equipment is used by the employee only, kept out of sight when not in use, and used in a room where screens and calls are not overheard.
• Paper containing Confidential information is not taken home unless approved; where it is, it is kept locked and returned or shredded.
• Loss or theft is reported within [1 hour]. In public places, a privacy screen filter is used and sensitive calls are avoided.
• Insurance covers equipment off-site, and the terms about unattended items are explained to users.

7.6 Secure disposal or re-use of equipment

1. IdentifyIT operations lists equipment due for retirement, sale, donation, return to lessor or re-use. Input: asset register and retirement report.
2. CheckConfirm no hold applies and that the data has been migrated or archived under the retention schedule.
3. SanitiseRemove storage devices or erase them using the methods in the Information Classification and Handling Procedure. For equipment sold or donated, verify erasure by a second person.
4. DisposeSend to an approved recycler or return to the lessor under a contract that requires secure handling, certificates of destruction and compliance with environmental rules for electronic waste.
5. Remove labelsRemove the asset tag, licence labels and Organisation markings from equipment leaving the Organisation, unless needed for traceability.
6. RecordUpdate the asset register to Disposed, attach certificates, and keep the records for [3 years]. See the Asset Disposal Process for the full workflow.

7.7 Unattended user equipment

• Users lock the screen whenever they leave a device, even briefly. Devices lock automatically after [5 minutes] of inactivity, enforced by configuration.
• Users log out of sessions to Restricted systems at the end of the work period and shut down or lock laptops when leaving the office.
• Laptops are locked away or cable-locked when left in the office overnight in open areas; in Zone 3 and 4 they may be left locked in the room.
• Security guards report unattended, unlocked screens found during rounds, and the user's manager is informed after [two] occurrences in a month.

7.8 Clean desk and clear screen

Facilities and security carry out clean desk inspections [monthly], using the checklist; findings are reported to the manager. Repeated failures are handled under the disciplinary process set by the HR Security Procedure.

7.9 Physical security incident reporting

1. ReportAnyone who sees a break-in, forced door, missing equipment, tailgating, lost pass, unescorted visitor, damaged secure room or environmental failure reports it at once to security or the service desk. Time: [immediately], and in writing within [4 hours].
2. ContainSecurity secures the area, preserves evidence including CCTV and access logs, and calls emergency services if there is danger or crime.
3. AssessThe Head of Facilities and the Head of IT Security decide whether information or equipment is affected and if the Incident Management Procedure applies. Time: [4 hours].
4. InvestigateCollect statements, logs, CCTV and inventory differences. Determine cause and whether the response was effective. Time: [5 working days].
5. FixRepair damage, change codes and keys, and block credentials. Record lessons and update the procedure. Evidence: incident report (Annexure E).
6. ReportInclude incidents in the monthly security report; losses of personal data or customer data are escalated for any statutory notification, with deadlines tracked from the time of awareness.

8. Server Rooms and Critical Technology Areas

Zone 4 rooms need extra care because a single event there can stop the whole business. The rules below apply to every server room, communication room and media store.

1. Request entryA person without standing access raises a ticket stating purpose, equipment and time window. The area owner approves. Target: [4 hours], or sooner for emergencies with after-the-fact approval within [1 working day].
2. EnterThe person uses their own credential; a second person present is recorded in the room log. Bags, food and drink are left outside.
3. WorkWork follows the approved change or maintenance record. Racks are opened only for the equipment named. Cabling changes are labelled and photographed.
4. LeaveThe room is checked for tools, packaging and waste; the rack is locked; the exit time is logged.
5. ReviewSecurity operations compare the room log, access system log and change tickets [weekly]; unexplained entries are investigated.

• Cardboard, packaging and combustible waste are removed on the same day and never stored in the room.
• New equipment is unpacked outside Zone 4 and inspected for tampering before it is moved in.
• A visitor or engineer in a Zone 4 room is never left alone, even for a short time.
• Environmental and door alarms are linked to a console watched [24 hours a day], with a call tree for out-of-hours response.

9. Deliveries, Loading Areas and Contractors

10. Physical Security Risk Assessment and Review

1. SurveyEach site is surveyed [annually] by facilities and IT security with a walk of the perimeter, entrances, utilities and neighbouring uses. Findings go into the site security survey record.
2. RateEach finding is rated by likelihood and impact as in the Risk Management Policy and entered in the risk register with an owner.
3. TreatFixes are scheduled by priority: High within [30 days], Medium within [90 days], Low within the next budget cycle. Compensating guarding is arranged if a fix is delayed.
4. TestOnce a year a planned exercise tests the controls, for example attempted tailgating or a mock visitor without a badge. Results are reported to the ISMS steering group.
5. UpdateRevise this procedure, zones and access lists after any site change, incident or exercise.

11. Physical Security Monitoring and Inspection

12. Measures

13. Records and Evidence

Annexure A: Visitor log

Annexure B: Asset movement form

Annexure C: Secure area access request

Annexure D: Equipment maintenance log

Annexure E: Physical security incident report

14. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

15. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

16. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Physical and Environmental Controls Policy
• Asset Management Procedure
• Asset Disposal Process
• Incident Management Procedure
• BCP and DR Procedure
• Acceptable Usage Policy
• Information Classification and Handling Procedure
• HR Security Procedure