Physical Security Policy
Physical protection of facilities, equipment and assets
Purpose
Protect the organization's facilities, assets and information against theft, unauthorized access and physical and environmental threats, ensuring business continuity, employee well-being and legal compliance.
Scope
Applies to employees, contractors, visitors and third parties with physical access to the organization's facilities or assets, both on-site and off-premises, worldwide.
Key Policy and Controls
Perimeter Security
- Fences, barriers and entrances designed according to risk assessment and asset criticality.
Facility Access Control
- Access limited to authorized staff, with electronic logging.
- Visitors always escorted.
Protection of Offices and Critical Infrastructure
- Access controls differentiated by location.
- Avoid external signage indicating critical areas.
Physical Surveillance
- CCTV on perimeters, entrances, loading docks and sensitive areas, continuously monitored by security staff.
Protection against Physical and Environmental Threats
- Response plans for natural disasters, explosives and other threats, reviewed and practiced regularly.
Secure Asset Handling
- Secure storage of assets and mandatory device locking when idle.
Cabling Security
- Cables protected against damage or interference; separation of power and data; additional controls on critical systems (armored conduits, locked rooms, electromagnetic shielding, periodic inspections).
- Physical labeling to identify cables.
Storage Media Management
- Secure lifecycle: acquisition, use, transport and disposal.
- Cryptography for confidential data, redundant copies and a log of removable media.
- Secure deletion and physical destruction of media where appropriate.
Security of Off-Site Assets
- Authorization and logging of assets taken off-premises.
- Protection of equipment in transit and in use in public places.
- Access control, tracking and remote wipe measures where possible.
- Additional protocols for equipment permanently installed off-premises.
Secure Asset Disposal
- Media containing sensitive data are securely erased or destroyed before disposal or reuse.
Compliance
All staff and entities involved must comply with this policy. Non-compliance may lead to disciplinary action.
Monitoring and Control
A Physical Security Team oversees implementation, audits and the annual review of the policy. The effectiveness of controls is continuously evaluated and adjusted according to emerging threats.