ISO 27001 Annex : A.11 Physical and Environmental Security

-

ISO 27001 Annex : A.11 Physical and Environmental Security in this article explain Secure areas, Physical Security Perimeter and Physical Entry Controls. 
A.11.1 Secure areas
Its objective is to avoid unauthorized physical access, damage and interference with the organization’s information and information processing facilities.
A.11.1.1 Physical Security Perimeter
Control- Security perimeters should be established in order to secure areas that contain either sensitive or confidential information and information processing facilities.
Implementation Guidance- When appropriate, for physical security perimeters, the following guidelines should be considered and implemented:
  1. Security perimeters should be established and the location and intensity of each perimeter should depend on the security requirements of the assets inside the perimeter and on the results of the risk assessment;
  2. The building or facility perimeters should be physically secure (i.e. there are no perimeter gaps or places where a break-in can easily occur); the site’s exterior buildings, walls, and floors should be securely built and all external doors should be properly secured against unauthorized controlled entry (e.g. bars, alarms, locks); Doors and windows should be locked when the windows are unattended and external security, especially at ground level, should be considered;
  3. There should be a manned reception area or other methods of physical access control for the site or building and only authorized personnel can access to sites and buildings.
  4. Physical barriers to prevent unauthorized physical access and environmental contamination should be built, wherever applicable;
  5. All fire doors should be alerted, monitored and tested alongside walls in order to determine the level of resistance needed in accordance with appropriate state, national and international standards; should act in a failsafe fashion in accordance with the Local Code;
  6. Appropriate intrusion detection systems, according to the national, regional, or international standards shall be installed and tested regularly for the coverage of all exterior doors and accessible windows. Unoccupied areas should be alarmed at all times.
  7. Organization-controlled information management facilities should be segregated physically from those operated by outside parties.
“ When you gambled with safety, you bet your life”
Other Information- The physical protection of the organization’s premises and information processing facilities can be achieved by creating one or several physical barriers. Additional protection is offered by using multiple barriers when a single barrier failure does not immediately affect security.
A protected space may be a closed office or multiple rooms that are enclosed with an internal physical protection restriction. Additional barriers and perimeters for the physical access control between areas with various security requirements within the safety perimeter may be necessary. And in the case of buildings with assets for multiple organizations, special attention to be given to physical security of entry.
The use of physical controls especially for the safe areas, as set out in the risk assessment, needs to be adjusted to the technical and economic circumstances of the organization.
The Organization wishes that its information to remain within the CIA triads. They also ensure that the physical security controls are properly and efficiently implemented to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities. The physical and environmental protection of the company is covered in Annex 11 of ISO 27002 . This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization. Infosavvy , a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the physical and environmental security of your organization that is necessary to protect the operations of your organization from attacks. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques
A.11.1.2 Physical Entry Controls
Control- Appropriate access controls should protect places to ensure that only authorized employees are allowed access.
Implementation Guidance- The following points should be taken into consideration:
  1. Visitors should be registered on the date and time of their entry and departure and should supervise all visitors, without prior approval of their access; Access should be given for certain approved purposes only, and guidelines should be provided regarding safety and emergency procedures specifications for the region. Visitors’ identity should be authorized using a suitable means;
  2. Access should be limited to areas where information is processed or stored by means of suitable access controls, for example, the introduction of a two-factor authentication system, such as an access card and a secret PIN;
Read More: https://www.info-savvy.com/iso-27001-annex-a-11-physical-and-environmental-security/

--------------------------------------------------------------------------------------------------------------------------

This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com

Comments

  1. pritam kumar21 April 2021 at 23:30

    Thanks for given detail information to me. keep posting like this. iso-45001-2018

    ReplyDelete

Post a Comment

Popular posts from this blog

10 Secrets You Will Never Know About Cyber Security And Its Important

-
Image
Know about Cyber Security Whether you’re a techie or not, there’s a good chance that your life is very reliant on the net and its wonders. Your social media accounts are likely humming, and you recognize your way round the IOT devices you employ . All of those devices connect you to the cyber world in a method or another. Here are 12 things to understand about  cyber security . And once you are sharing such a lot of your data online daily, you may also care about your cyber security.  If you’ve always thought cyber security are a few things only big companies got to care about change your mind, now. Cyber security is as critical on a private level, because it is on a company’s level. Besides, there’s hardly any job or profession, that’s not supported technology. With  jobs or a career in mind , you need to understand what threatens your security online and what you’ll be able to do to stay your data secure. 1  You’re a target to hackers Don’t ever say...
Read more

ISO 27001 Annex : A.5 Information Security Policies

-
Image
5. 1  Management direction for information security ISO 27001 Annex : A.5 Information Security Policies, Its objective is to provide management guidance and  information security  assistance in accordance with business requirements and relevant laws and regulations. 5.1.1 Policies for Information Security Control-   A set of information security policies should be established, managed accepted, published and communicated to the employees and related external parties. Implementation Guidance-  At the very least companies need to identify a management-approved “information security strategy,” which outlines the organization’s approach to managing its information security goals. Information security policies should meet criteria that have been created by: Business strategy; Regulations, legislation and contracts; The present and projected  information security threat  environment Related Product :   ISO 27001 Lead...
Read more

Impact Of ISO 27001 Lead Auditor

-
Image
Information Security Management System  ISO 27001   Standard is an Information Security Management System. The main objective of this standard is the organization shall establish, implement and maintain the information security system within the organization. Evaluate the information security Risk at each stage of operation and take the necessary action to reduce the information security Risk within the organization. In common business practice the ISO 27001 standard is also referred as ISMS standard. The summarized requirement details of ISO 27001 are given below: Context of The Organization The organization shall identify the internal and external issue related to  information security , including the legal, regulatory and contractual requirements. Determining the scope of information security management system and establishing the information security management system. Leadership The top management of the organization demonstrates the leadership and ...
Read more