Introduction:
Physical security is a critical aspect of any organization’s security program.
It is the first line of defense against external and internal threats to an organization’s assets, including data, people, and infrastructure.
Physical security measures include access controls, video surveillance, alarm systems, and fire protection systems, among others. ISO/IEC 27001:2013 has a set of controls related to physical security.
This article will focus on control A.11.1.5, which covers working in secure areas.
Sample Checklist:
- Are supposedly vacated offices, IT rooms, and other secure workplaces checked at the end of the day for safety and security reasons?
- Are secure areas risk-assessed with suitable controls implemented, such as physical access controls, intruder alarms, CCTV monitoring (check the retention and frequency of review), photographic, video, audio, or other recording equipment (including cameras and microphones in portable devices) prohibited, and policies, procedures, and guidelines?
- How are details of proprietary business processes/activities in various areas of the facility kept confidential to authorized personnel?
Conclusion:
Control A.11.1.5 requires organizations to ensure that their secure areas are adequately protected from internal and external threats.
This control emphasizes the importance of risk assessment and the implementation of appropriate controls to mitigate the risks identified.
Organizations should also ensure that vacated offices and IT rooms are checked for safety and security reasons at the end of each day.
Lastly, the organization must have policies, procedures, and guidelines in place to ensure that details of proprietary business processes/activities in various areas of the facility are kept confidential to authorized personnel.
Compliance with A.11.1.5 will help organizations safeguard their assets, including sensitive information and intellectual property.
