65 lines
2.5 KiB
Markdown
65 lines
2.5 KiB
Markdown
Title: Physical Security Policy
|
|
Document ID: [POL-PHYSICAL-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Physical Security Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's high-level requirements for protecting physical environments, assets, and information from unauthorised physical access, damage, or interference.
|
|
|
|
## Scope
|
|
|
|
This policy applies to offices, shared workspaces, storage areas, endpoint handling, and any other physical locations or facilities used for in-scope business activity. It also applies, where relevant, to third-party facilities that support in-scope operations.
|
|
|
|
## Objectives
|
|
|
|
- reduce risk arising from unauthorised physical access or asset loss
|
|
- protect equipment and information used in business operations
|
|
- support secure working across office, remote, and supplier-hosted environments
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Physical access to locations handling sensitive information or important technology assets must be controlled according to risk and business need.
|
|
|
|
Equipment and media containing sensitive information must be protected from theft, loss, damage, or unauthorised use.
|
|
|
|
BlackDice must consider physical risks associated with office environments, remote working, shipped equipment, and any third-party hosting or operational facilities relevant to in-scope services.
|
|
|
|
Clear desk, screen protection, visitor control, and secure disposal practices should be applied where appropriate to the working environment and information handled.
|
|
|
|
Physical security responsibilities for supplier or cloud-hosted facilities must be understood as part of supplier and shared-responsibility arrangements.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define physical security expectations.
|
|
- Location and asset owners must apply physical protections appropriate to their environments.
|
|
- Personnel must protect assets and information from avoidable physical exposure.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Exceptions to required physical security measures must be documented and approved according to risk.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through incidents, asset issues, supplier assurance, and audit.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Remote Working Policy
|
|
- Asset Management and Acceptable Use Policy
|
|
- Supplier Security Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|