ISO 27001 Annex : A.11.1.3 Securing Offices, Rooms and Facilities, A.11.1.4 Protecting Against External and Environmental Threats, A.11.1.5 Working in Secure Areas & A.11.1.6 Delivery and Loading Areas

In this article explained ISO 27001 Annex : A.11.1.3 Securing Offices Rooms and Facilities, A.11.1.4 Protecting Against External and Environmental Threats, A.11.1.5 Working in Secure Areas, A.11.1.6 Delivery and Loading Areas.

A.11.1.3 Securing Offices, Rooms and Facilities

Control- Physical security should be designed and implemented for the offices, rooms, and facilities.

Implementation Guidance- The following guidelines for safeguarding offices, spaces, and services should be considered:

1. Key facilities should be situated to avoid public access;
2. The presence of the information processing activities should be indicated unobtrusively where appropriate and offer a minimum indication of their intent and no obvious signs outside or inside the building;
3. In order to avoid sensitive information or events that are visible and audible outside, facilities should be installed. Electromagnetic security should also be taken into account as appropriate;
4. Directories and internal telephone books which identify sites where confidential information processing facilities should not be readily available to unauthorized persons.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A.11.1.4 Protecting Against External and Environmental Threats

Control- Physical protection should be designed and applied against natural disasters, malicious attacks or accidents.

Implementation Guidance- Specialized advice on how to prevent fire damage, flood, earthquake, blast, civil disaster and other types of natural or man-made disaster.

“ When you gambled with safety, you bet your life”

The Organization wishes that its information to remain within the CIA triads. They also ensure that the physical security controls are properly and efficiently implemented to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities. The physical and environmental protection of the company is covered in Annex 11 of ISO 27002 . This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization. Infosavvy , a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the physical and environmental security of your organization that is necessary to protect the operations of your organization from attacks. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques

A.11.1.5 Working in Secure Areas

Control- Procedures should be designed and implemented for working in safe areas.

Implementation Guidance- The following guidelines should be taken into account:

1. Workers can only know on a need to know basis the presence of activities within a secure area;
2. Unattended work in safe areas, both for reasons of safety and to prevent malicious activities opportunities should be avoided;
3. Vacant secure areas should be physically closed and periodically reviewed;
4. Photographic, video, audio or other recording equipment, such as cameras on mobile devices, should not be allowed unless it is authorized to do so.

Safe-area work arrangements provide safeguards for employees and external party users operating in a secure area that include all activities taking place in a secure area.

Also Read :  ISO 27001 Annex : A.11.2 Equipment

A.11.1.6 Delivery and Loading Areas

Control- It is important to track and, where possible, differentiate between access points such as the distribution and loading areas and other locations in order to avoid unauthorized access by unauthorized persons to the premises.

Implementation guidance- The following guidelines should be taken into account:

1. Identified and authorized personnel should restrict access to the delivery area and the loading area from outside the building;
2. The supply and loading area should be designed so as to allow the loading and unloading of the supplies without access to other parts of the building by delivery personnel;
3. When opening the interior doors, external doors of a storage and storage area should be secured;
4. Receiving material shall be inspected before it is transported from the shipping and loading area and tested for explosives, chemicals or other hazardous materials;
5. Incoming material should be documented on-site entry in compliance with procedures for asset management (Refer to Clause 8).
6. shipments in and out should be physically separated, where possible;
7. Incoming material for the evidence of tampering should be inspected. If such manipulation is found, the security personnel should be informed immediately.

Questions related to this topic

1. What is A.11.1.3 Securing Offices, Rooms and Facilities?
2. What is A.11.1.4 Protecting Against External and Environmental Threats?
3. What is A.11.1.5 Working in Secure Areas?
4. What is A.11.1.6 Delivery and Loading Areas?
5. What are the controls of Annex A.11 Physical and Environmental Security part 2?
6. What is difference between A.11.1.3 Securing Offices, Rooms and Facilities & What is A.11.1.4 Protecting Against External and Environmental Threats?
7. What are the controls of ISO 27001 Annex : A.11.1.3 Securing Offices Rooms and Facilities?

---