A.7.3
Securing offices, rooms and facilities
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
The purpose is to design and apply physical security to the individual offices, rooms, and facilities where information and information processing activities take place, so that unauthorized access, viewing, damage, and external disclosure of information are prevented. Whereas the physical security perimeter (A.7.1) encloses a whole area, this control requires each space inside that perimeter to implement layout, screening, and low visibility in proportion to the sensitivity of the information it handles. As a result, the location of critical facilities and the activity inside them are not readily apparent to outsiders, and each space is protected in proportion to the value of the assets it contains.
Key checkpoints
- Is the physical security requirement level for each office, room, and facility defined from the sensitivity of the information it handles and the risk assessment, and reflected in its design?
- Are critical facilities such as server rooms, communication rooms, and document stores placed away from outsider traffic and separated from general office space?
- Do signage, directories, door signs, and publicly available material avoid needlessly revealing the location and purpose of critical information processing facilities?
- Are measures in place so that screens, documents, and work inside cannot be observed, and conversations cannot be overheard, from outside through windows, glass walls, or open spaces?
- Are offices and facilities kept locked or sealed during unattended and out-of-hours periods, and is there a procedure to check that state?
- Have the siting and internal design of critical spaces accounted for natural and man-made hazards such as fire, flooding, explosion, and civil disturbance?
Implementation guidance
- Set the physical security requirement level for each office, room, and facility from the sensitivity of the information it handles, and document the protective measures and responsibilities per space.
- Locate critical facilities such as server rooms, communication rooms, and document stores away from lobbies, reception, and shared corridors where outsiders are frequent, and isolate them from general work areas.
- Reduce unnecessary disclosure of critical facility locations and functions in external signage, directories, door labels, and public material. Retain signs needed for fire safety, evacuation, safe work, and emergency response.
- Fit blinds, film, or partitions to windows and glass walls that expose the interior, and site spaces used for sensitive discussion with soundproofing and screening in mind.
- Keep offices and facilities locked during out-of-hours and unattended periods, and periodically check keys, access media, and locking status to remediate anomalies.
- Site critical spaces away from flood-prone basements or top floors, vulnerable positions adjacent to outer walls, and areas near hazardous-material storage, and design them together with fire and water-leak detection and HVAC and power provisions.
- Reassess the physical security requirement level when an office or facility is newly established, relocated, or repurposed, and update floor plans, the space inventory, and protective-measure documentation.
Evidence
- Guideline defining the physical security requirement level and protective measures per space
- Facility floor plans showing the location of critical facilities and their separation from general space, plus a space/facility inventory
- Standard and status records for signage, directory, and door-sign entries
- Status of exposure-prevention measures such as window/glass-wall screening, soundproofing, and partitions
- Locking inspection checklist and records for offices and facilities during unattended periods
- Reassessment and approval records for security requirement levels when spaces are established, relocated, or repurposed
Nonconformity examples
- The server room sits directly beside the lobby/reception, so outsiders are constantly nearby and it is not separated from general space.
- External directions disclose excessive detail about critical facility locations and access without reviewing necessity and risk.
- Work screens and documents can be observed from outside through a large street-facing glass wall, with no screening in place.
- Document stores and work rooms are left unlocked out of hours and there is no procedure to check locking status.
- Critical facilities are located in a basement with a history of flooding, with no water-leak or fire detection considered.
- After an office relocation the security requirement level was not reassessed and floor plans were not updated, so documentation does not match reality.