Objective: Security zones provide physical protection of information assets. The more sensitive the information assets to be processed are the more protective measures are required.
Requirements (must): A security zone concept including the associated protective measures based on the requirements for the handling of information assets is in place:
- Physical conditions (e.g. premises / buildings / spaces) are considered in the definition of security zones,
- This also includes delivery and shipping areas.
The defined protective measures are implemented.
The code of conduct for security zones is known to all persons involved.
Requirements (should): Procedures for allocation and revocation of access rights are established.
Visitor management policies (including registration and escorting of visitors) are defined.
Policies for carrying along and using mobile IT devices and mobile data storage devices (e.g. registration before they are carried along, identification obligations) are defined and implemented.
Network/infrastructure components (own or customer networks) are protected against unauthorized access.
External properties used for storing and processing information assets are considered in the security zone concept (e.g. storage rooms, garages, workshops, test tracks, data processing centres).
Cyber criminals can exploit configuration errors or technical vulnerabilities in applications, firewalls, or networks to access our information.
An organization must use defense-in-depth technologies to protect against, detect, and respond to cyber-attacks. The techniques should be suitable for controlling physical, logical and administrative controls.
Secure areas of the organization cannot be accessed unnoticed. The premises are protected by appropriate access control. Only authorized persons have access to the secure areas.
Visitors shall have access to secure areas only with permission, after they are appropriately identified and their access rights shall be limited to the necessary facilities. All visits are recorded in the visitor log. In addition, staff have guidelines about safe operating in connection with visits.
Organization has defined the areas for handling confidential information and the operating rules that are followed in all activities that take place in the corresponding areas.
In the rules, consideration should be given to the following points:
Access to areas where confidential information is handled or stored should be restricted to authorized individuals through appropriate access control, e.g. using a two-step authentication mechanism such as an access card and a passcode.
People can't move around the organization's premises without a visible identifier.
An owner is defined for an organization's networks. The owner is responsible for planning the structure of the network and documenting it.
Separate network areas are used in network design as needed. Domain areas can be defined by e.g.:
Separation can be implemented either with physically separate networks or with logically separate networks.
Organisation's premises and the operating environments of the equipment are actively protected by security.
External support staff, such as maintenance or cleaning staff, will only be granted access to the necessary security areas and confidential data processing services they need. Access rights for external support staff are reviewed regularly.
Security personnel use camera surveillance to verify unauthorized access, sabotage, or other alarms at the organization's premises.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
