ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

NOTES AND COMMENTS

9.1 USE SECURITY AREAS TO PROTECT FACILITIES

1

GOAL

Do you use physical methods to prevent unauthorized

access to your organizations information and premises?

YES

NO

N/A

GOAL

Do you use physical methods to prevent people

from damaging your information and premises?

YES

NO

N/A

GOAL

Do you use physical methods to prevent people

from interfering with your information and premises?

YES

NO

N/A

GOAL

Do you keep your organizations critical or sensitive

information processing facilities in secure areas?

YES

NO

N/A

GOAL

Do you use defined security perimeters to protect your

critical or sensitive information processing facilities?

YES

NO

N/A

GOAL

Do you use appropriate security barriers to protect your

critical or sensitive information processing facilities?

YES

NO

N/A

GOAL

Do you use entry controls to protect your critical

or sensitive information processing facilities?

YES

NO

N/A

GOAL

Are your physical protection methods

commensurate with identified security risks?

YES

NO

N/A

9.1.1 USE PHYSICAL SECURITY PERIMETERS TO PROTECT AREAS

9

CTRL

Do you use physical security perimeters and

barriers to protect areas that contain information?

YES

NO

N/A

10

CTRL

Do you use physical security perimeters and barriers to

protect areas that contain information processing facilities?

YES

NO

N/A

11

CTRL

Do you use walls to protect areas that contain your

information and information processing facilities?

YES

NO

N/A

12

CTRL

Do you use manned reception desks to protect areas that

contain information and information processing facilities?

YES

NO

N/A

13

CTRL

Do you use card controlled entry gates to protect areas that

contain information and information processing facilities?

YES

NO

N/A

14

GUIDE

Are your security perimeters clearly defined?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 84

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

15

GUIDE

Do you assess your security risks and make sure that your
security perimeters actually reduce your security risk?

YES

NO

N/A

16

GUIDE

Do you assess your information asset security

requirements and make sure that your security
perimeters meet those requirements?

YES

NO

N/A

17

GUIDE

Do you reduce your risk and meet your security

requirements by ensuring that security perimeters
are properly sited?

YES

NO

N/A

18

GUIDE

Do you reduce your risk and meet your security

requirements by ensuring that security perimeters
are strong enough?

YES

NO

N/A

19

GUIDE

Are your physical security barriers and perimeters

free of physical gaps and weaknesses?

YES

NO

N/A

20

GUIDE

Are external walls of buildings and sites that contain

information processing facilities solidly constructed?

YES

NO

N/A

21

GUIDE

Do you use external door control mechanisms to prevent

unauthorized access to information processing facilities?

YES

NO

N/A

22

GUIDE

Do you use bars to prevent unauthorized access to

your organizations information processing facilities?

YES

NO

N/A

23

GUIDE

Do you use locks to prevent unauthorized access to

your organizations information processing facilities?

YES

NO

N/A

24

GUIDE

Do you use alarms to prevent unauthorized access to

your organizations information processing facilities?

YES

NO

N/A

25

GUIDE

Are your doors locked when unattended?

YES

NO

N/A

26

GUIDE

Are your windows locked when unattended?

YES

NO

N/A

27

GUIDE

Do you use external protection for windows at ground level?

YES

NO

N/A

28

GUIDE

Do you use physical access controls to ensure that access

to sites and buildings is restricted to authorized personnel?

YES

NO

N/A

29

GUIDE

Do you use physical barriers to prevent unauthorized access?

YES

NO

N/A

30

GUIDE

Do you use physical barriers to prevent contamination

from external environmental sources?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 85

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

31

GUIDE

Do you alarm all external perimeter fire doors?

YES

NO

N/A

32

GUIDE

Do you monitor all external perimeter fire doors?

YES

NO

N/A

33

GUIDE

Are external perimeter fire doors and walls strong

enough and provide the required resistance?

YES

NO

N/A

34

GUIDE

Do you test all external perimeter fire doors in

conjunction with surrounding walls to ensure that
they comply with all relevant regional, national,
and international standards?

YES

NO

N/A

35

GUIDE

Do external perimeter fire doors comply with local fire codes?

YES

NO

N/A

36

GUIDE

Are your external perimeter fire doors failsafe?

YES

NO

N/A

37

GUIDE

Have you installed suitable intruder detection systems?

YES

NO

N/A

38

GUIDE

Do your intruder detection systems cover

all external doors and accessible windows?

YES

NO

N/A

39

GUIDE

Do your intruder detection systems cover all

communications centers and computer rooms?

YES

NO

N/A

40

GUIDE

Do your intruder detection systems comply with all

relevant regional, national, or international standards?

YES

NO

N/A

41

GUIDE

Do you test all intruder detection systems in order to

ensure that they comply with all relevant standards?

YES

NO

N/A

42

GUIDE

Do you alarm your unoccupied areas at all times?

YES

NO

N/A

43

GUIDE

Have you separated your organizations information

processing facilities from those managed by third parties?

YES

NO

N/A

44

NOTE

Have you considered using multiple physical barriers to

protect your premises and information processing facilities?

YES

NO

N/A

45

NOTE

Do you use lockable offices to protect your organizations

information and information processing facilities?

YES

NO

N/A

46

NOTE

Do you use continuous internal physical security barriers to

protect your information and information processing facilities?

YES

NO

N/A

47

NOTE

Do you use special physical access security precautions

when multiple organizations are housed in the same building?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 86

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

NOTES AND COMMENTS

9.1.2 USE PHYSICAL ENTRY CONTROLS TO PROTECT SECURE AREAS

48

CTRL

Do you use physical entry controls to protect secure areas?

YES

NO

N/A

49

CTRL

Do your physical entry controls allow only authorized

personnel to gain access to secure areas?

YES

NO

N/A

50

GUIDE

Do you record the date and time

visitors enter or leave secure areas?

YES

NO

N/A

51

GUIDE

Do you supervise all visitors to secure areas

unless their access was previously approved?

YES

NO

N/A

52

GUIDE

Do you allow access to secure areas only if access

has been authorized and visitors have a specific
reason why they need to have access?

YES

NO

N/A

53

GUIDE

Do all visitors to secure areas understand the security

requirements that apply to the areas being visited?

YES

NO

N/A

54

GUIDE

Are all visitors to secure areas made aware of the

emergency procedures that apply to those areas?

YES

NO

N/A

55

GUIDE

Do you control access to areas where

sensitive information is stored?

YES

NO

N/A

56

GUIDE

Do you control access to areas where

sensitive information is processed?

YES

NO

N/A

57

GUIDE

Do you restrict access to authorized personnel only?

YES

NO

N/A

58

GUIDE

Do you use authentication controls (e.g., access control

card plus PIN) to validate and authorize access?

YES

NO

N/A

59

GUIDE

Do you maintain secure records of all access to secure areas?

YES

NO

N/A

60

GUIDE

Do all employees wear visible identification?

YES

NO

N/A

61

GUIDE

Do all contractors wear visible identification?

YES

NO

N/A

62

GUIDE

Do all third-party users wear visible identification?

YES

NO

N/A

63

GUIDE

Do all visitors wear visible identification?

YES

NO

N/A

64

GUIDE

Do all personnel notify your security people if they

encounter anyone not wearing visible identification?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 87

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

65

GUIDE

Do you allow third-party support service personnel to access

secure areas only when necessary and only if authorized?

YES

NO

N/A

66

GUIDE

Do you allow third-party support service personnel to

access sensitive information processing facilities only
when necessary and only if authorized?

YES

NO

N/A

67

GUIDE

Do you monitor third-party support service personnel while

they have access to secure areas and sensitive facilities?

YES

NO

N/A

68

GUIDE

Do you review access rights to

secure areas on a regular basis?

YES

NO

N/A

69

GUIDE

Do you update access rights to

secure areas on a regular basis?

YES

NO

N/A

70

GUIDE

Do you revoke access rights to secure

areas when it is necessary to do so?

YES

NO

N/A

NOTES AND COMMENTS

9.1.3 SECURE YOUR ORGANIZATIONS OFFICES, ROOMS, AND FACILITIES

71

CTRL

Have you designed physical security controls and do

you apply them to your offices, rooms, and facilities?

YES

NO

N/A

72

GUIDE

Do your physical security controls comply with all

relevant health and safety regulations and standards?

YES

NO

N/A

73

GUIDE

Do you site important or sensitive facilities

in order to avoid public access to them?

YES

NO

N/A

74

GUIDE

Are buildings, which are used for information processing,

unobtrusive and do they conceal their true purpose?

YES

NO

N/A

75

GUIDE

Do you prevent public access to internal telephone books,

directories, and documents that identify the location
of sensitive information processing facilities?

YES

NO

N/A

9.1.4 PROTECT FACILITIES FROM NATURAL AND HUMAN THREATS

76

CTRL

Do you use physical methods to protect your facilities

from the damage that natural disasters can cause?

YES

NO

N/A

77

CTRL

Do you use physical methods to protect your facilities

from the damage that man-made disasters can cause?

YES

NO

N/A

78

CTRL

Do you use physical methods to protect your

facilities from the damage that fires can cause?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 88

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

79

CTRL

Do you use physical methods to protect your

facilities from the damage that floods can cause?

YES

NO

N/A

80

CTRL

Do you use physical methods to protect your facilities

from the damage that earthquakes can cause?

YES

NO

N/A

81

CTRL

Do you use physical methods to protect your facilities

from the damage that explosions can cause?

YES

NO

N/A

82

CTRL

Do you use physical methods to protect your facilities

from the damage that civil unrest can cause?

YES

NO

N/A

83

GUIDE

Do you protect your facilities from the security threats

that neighboring premises could potentially present?

YES

NO

N/A

84

GUIDE

Do you protect your facilities from the damage

a fire in a neighboring building could cause?

YES

NO

N/A

85

GUIDE

Do you protect your facilities from the damage

an explosion in the street could cause?

YES

NO

N/A

86

GUIDE

Do you protect your facilities from the damage

water leaking from the roof, from below, or from
the next office could cause?

YES

NO

N/A

87

GUIDE

Do you store hazardous materials away from secure areas?

YES

NO

N/A

88

GUIDE

Do you store combustible materials away from secure areas?

YES

NO

N/A

89

GUIDE

Do you site fallback equipment at a safe distance from

the main site in order to ensure that it isnt damaged
if the main site experiences a disaster?

YES

NO

N/A

90

GUIDE

Is appropriate fire fighting equipment suitably

situated and available when needed?

YES

NO

N/A

NOTES AND COMMENTS

9.1.5 USE WORK GUIDELINES TO PROTECT SECURE AREAS

91

CTRL

Do you use guidelines to control how

work is performed in secure areas?

YES

NO

N/A

92

GUIDE

Do you control how employees

perform work in secure areas?

YES

NO

N/A

93

GUIDE

Do you control how contractors

perform work in secure areas?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 89

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

94

GUIDE

Do you control how third-party users

perform work in secure areas?

YES

NO

N/A

95

GUIDE

Do you use a need-to-know policy to control what personnel

know about the work that is done in secure areas?

YES

NO

N/A

96

GUIDE

Do you supervise all work performed in secure areas?

YES

NO

N/A

97

GUIDE

Do you lock secure areas that are vacant?

YES

NO

N/A

98

GUIDE

Do you check secure areas that are vacant?

YES

NO

N/A

99

GUIDE

Do you prevent the unauthorized use of

recording equipment inside secure areas?

YES

NO

N/A

100

GUIDE

Do you prevent the unauthorized use of

photographic equipment inside secure areas?

YES

NO

N/A

101

GUIDE

Do you prevent the unauthorized use of

video equipment inside secure areas?

YES

NO

N/A

102

GUIDE

Do you prevent the unauthorized use of

audio equipment inside secure areas?

YES

NO

N/A

NOTES AND COMMENTS

9.1.6 ISOLATE AND CONTROL PUBLIC ACCESS POINTS

103

CTRL

Do you control public access points in order to prevent

unauthorized persons from entering your premises?

YES

NO

N/A

104

CTRL

Are public access points isolated and separate

from your information processing facilities?

YES

NO

N/A

105

CTRL

Do you isolate and control access to your delivery areas?

YES

NO

N/A

106

CTRL

Do you isolate and control access to your loading areas?

YES

NO

N/A

107

GUIDE

Do you restrict access to delivery and loading areas in order

to prevent unauthorized access from outside of your building?

YES

NO

N/A

108

GUIDE

Are only identified and authorized personnel allowed to

access your organizations delivery and loading areas?

YES

NO

N/A

109

GUIDE

Are delivery and loading areas designed so that supplies

can be unloaded without allowing delivery personnel to
have access to the rest of the building?

YES

NO

N/A

110

GUIDE

Are your delivery and loading areas designed so that

external doors are secured when internal doors are open?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 90

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

111

GUIDE

Do you inspect all incoming supplies and materials to ensure

that all hazards are identified before these items are
transferred from delivery and loading areas to points of use?

YES

NO

N/A

112

GUIDE

Do you register all supplies and

materials when they enter your site?

YES

NO

N/A

113

GUIDE

Are incoming registration activities carried out in

accordance with your asset management procedures?

YES

NO

N/A

114

GUIDE

Do you segregate your incoming and outgoing shipments?

YES

NO

N/A

NOTES AND COMMENTS

9.2 PROTECT YOUR ORGANIZATIONS EQUIPMENT

115

GOAL

Do you prevent damage to your organizations equipment?

YES

NO

N/A

116

GOAL

Do you prevent the loss of your organizations equipment?

YES

NO

N/A

117

GOAL

Do you prevent the theft of your organizations equipment?

YES

NO

N/A

118

GOAL

Do you protect your equipment from physical threats?

YES

NO

N/A

119

GOAL

Do you protect your equipment from environmental threats?

YES

NO

N/A

120

GOAL

Do you protect your equipment to avoid work interruptions?

YES

NO

N/A

121

GOAL

Do you protect your equipment in order to avoid

unauthorized access to your organizations information?

YES

NO

N/A

122

GOAL

Do you protect your equipment through proper disposal?

YES

NO

N/A

123

GOAL

Do you use secure siting strategies to protect equipment?

YES

NO

N/A

124

GOAL

Do you use special controls to protect supporting facilities?

YES

NO

N/A

9.2.1 USE EQUIPMENT SITING AND PROTECTION STRATEGIES

125

CTRL

Do you protect your equipment from environmental risks

and hazards through the use of secure siting strategies?

YES

NO

N/A

126

CTRL

Do you prevent opportunities for unauthorized access to

equipment through the use of secure siting strategies?

YES

NO

N/A

127

GUIDE

Do you site your organizations equipment so that

unnecessary access to work areas is minimized?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 91

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

128

GUIDE

Do you position information processing facilities

so that sensitive information cannot be viewed
by unauthorized persons?

YES

NO

N/A

129

GUIDE

Do you position information storage facilities

so that sensitive information cannot be viewed
by unauthorized persons?

YES

NO

N/A

130

GUIDE

Do you isolate your equipment when

it requires an extra level of protection?

YES

NO

N/A

131

GUIDE

Do you use security controls to minimize

the risk that equipment could be damaged
by physical threats and hazards?

YES

NO

N/A

132

GUIDE

Do you use security controls to minimize

the risk that equipment will be stolen?

YES

NO

N/A

133

GUIDE

Do you use security controls to minimize

the risk that equipment will be vandalized?

YES

NO

N/A

134

GUIDE

Do you use security controls to minimize the

risk that equipment will be damaged by fire?

YES

NO

N/A

135

GUIDE

Do you use security controls to minimize the

risk that equipment will be damaged by smoke?

YES

NO

N/A

136

GUIDE

Do you use security controls to minimize the risk

that equipment will be damaged by explosives?

YES

NO

N/A

137

GUIDE

Do you use security controls to minimize the risk

that equipment will be damaged by flooding?

YES

NO

N/A

138

GUIDE

Do you use security controls to minimize the risk

that equipment will be damaged by water leaks?

YES

NO

N/A

139

GUIDE

Do you use security controls to minimize the

risk that equipment will be damaged by dust?

YES

NO

N/A

140

GUIDE

Do you use security controls to minimize the

risk that equipment will be damaged by grime?

YES

NO

N/A

141

GUIDE

Do you use security controls to minimize the risk

that equipment will be damaged by vibration?

YES

NO

N/A

142

GUIDE

Do you use security controls to minimize the risk

that equipment will be damaged by destructive
or corrosive chemicals?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 92

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

143

GUIDE

Do you use security controls to minimize the risk that

equipment will be damaged by electromagnetic radiation?

YES

NO

N/A

144

GUIDE

Do you use security controls to minimize the risk that

equipment will be damaged by electrical interference?

YES

NO

N/A

145

GUIDE

Do you use security controls to minimize the risk

that equipment will be accidentally damaged?

YES

NO

N/A

146

GUIDE

Have you established guidelines to control eating, drinking,

and smoking near your information processing facilities?

YES

NO

N/A

147

GUIDE

Do you monitor environmental conditions when changes

could damage your information processing facilities?

YES

NO

N/A

148

GUIDE

Do you monitor temperature and humidity when

these conditions could impair the operation of your
organizations information processing facilities?

YES

NO

N/A

149

GUIDE

Do you protect your buildings from lightning strikes?

YES

NO

N/A

150

GUIDE

Do you protect incoming power lines

using lightning protection filters?

YES

NO

N/A

151

GUIDE

Do you protect incoming communications

lines using lightning protection filters?

YES

NO

N/A

152

GUIDE

Do you use special methods to protect equipment

that is used in harsh industrial environments?

YES

NO

N/A

153

GUIDE

Do you use keyboard membranes to protect equipment

that is used in harsh industrial environments?

YES

NO

N/A

154

GUIDE

Do you protect equipment that is used to process

sensitive information by minimizing the risk that
information will leak due to emanation?

YES

NO

N/A

NOTES AND COMMENTS

9.2.2 MAKE SURE THAT SUPPORTING UTILITIES ARE RELIABLE

155

CTRL

Do you protect your equipment from

disruptions caused by utility failures?

YES

NO

N/A

156

CTRL

Do you protect your equipment from

disruptions caused by power failures?

YES

NO

N/A

157

GUIDE

Are all supporting utilities capable of

supporting your organizations systems?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 93

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

158

GUIDE

Are all electrical utilities capable of

supporting your organizations systems?

YES

NO

N/A

159

GUIDE

Does your electrical supply conform to your

equipment manufacturers specifications?

YES

NO

N/A

160

GUIDE

Are water utilities capable of supporting your systems?

YES

NO

N/A

161

GUIDE

Are sewage utilities capable of supporting your systems?

YES

NO

N/A

162

GUIDE

Are heating utilities capable of supporting your systems?

YES

NO

N/A

163

GUIDE

Are ventilation systems capable of supporting your systems?

YES

NO

N/A

164

GUIDE

Is your air conditioning system capable

of supporting your organizations systems?

YES

NO

N/A

165

GUIDE

Do you inspect your supporting utilities regularly

in order to make sure that theyre still functioning
properly and in order to reduce the risk of failure?

YES

NO

N/A

166

GUIDE

Do you test your supporting utilities regularly in

order to make sure that theyre still functioning
properly and in order to reduce the risk of failure?

YES

NO

N/A

167

GUIDE

Do you use uninterruptible power supplies (UPSs) to protect

equipment that is used to support critical business operations?

YES

NO

N/A

168

GUIDE

Have you established power contingency plans that

explain what should be done when your UPSs fail?

YES

NO

N/A

169

GUIDE

Do you check your UPS equipment regularly?

YES

NO

N/A

170

GUIDE

Do you test your organizations UPS equipment regularly

in accordance with manufacturers recommendations?

YES

NO

N/A

171

GUIDE

Do you have backup generators that you

can use during prolonged power failures?

YES

NO

N/A

172

GUIDE

Do you have an adequate supply of fuel available that

backup generators can use during emergencies?

YES

NO

N/A

173

GUIDE

Do you check your backup generators regularly?

YES

NO

N/A

174

GUIDE

Do you test your backup generators regularly in

accordance with manufacturers recommendations?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 94

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

175

GUIDE

Have you considered using multiple power sources?

YES

NO

N/A

176

GUIDE

Have you considered using a separate

power substation if your site is large?

YES

NO

N/A

177

GUIDE

Are emergency power-off switches located

near emergency exits in equipment rooms?

YES

NO

N/A

178

GUIDE

Have you installed emergency backup

lights in case your main power fails?

YES

NO

N/A

179

GUIDE

Is your water supply stable and capable of

supporting your air conditioning equipment?

YES

NO

N/A

180

GUIDE

Is your water supply stable and capable

of supporting your humidification equipment?

YES

NO

N/A

181

GUIDE

Is your water supply stable and capable

of supporting your fire suppression systems?

YES

NO

N/A

182

GUIDE

Have you considered installing alarm systems

to detect malfunctions in supporting utilities?

YES

NO

N/A

183

GUIDE

Do you use two different routes to connect your

telecommunications equipment to your utility provider?

YES

NO

N/A

184

GUIDE

Do your voice services comply with local legal

emergency communications requirements?

YES

NO

N/A

185

NOTE

Have you considered using multiple feeds to avoid a single

point of failure and to ensure that power supply is continuous?

YES

NO

N/A

NOTES AND COMMENTS

9.2.3 SECURE POWER AND TELECOMMUNICATIONS CABLES

186

CTRL

Do you protect power cables carrying

data or supporting information services?

YES

NO

N/A

187

CTRL

Do you protect telecommunications cables

carrying data or supporting information services?

YES

NO

N/A

188

CTRL

Do you protect cables from damage and deterioration?

YES

NO

N/A

189

CTRL

Do you protect cables from unauthorized interception?

YES

NO

N/A

190

GUIDE

Do you place power lines underground whenever those

lines are connected to information processing facilities?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 95

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

191

GUIDE

Do you place telecommunications cables underground when

they are connected to information processing facilities?

YES

NO

N/A

192

GUIDE

Do you avoid routing network cables through public areas?

YES

NO

N/A

193

GUIDE

Do you use conduits to prevent unauthorized

interception or damage to network cables?

YES

NO

N/A

194

GUIDE

Do you prevent interference by segregating

power cables from telecommunications cables?

YES

NO

N/A

195

GUIDE

Do you use clearly marked cable and equipment

markings in order to minimize the chance that the
wrong network cables will be accidentally patched?

YES

NO

N/A

196

GUIDE

Do you use documented patch lists in order

to reduce the chance that the wrong network
cables will be accidentally patched?

YES

NO

N/A

197

GUIDE

Do you use armored conduit to

protect sensitive or critical systems?

YES

NO

N/A

198

GUIDE

Do you protect sensitive or critical systems by using

locked rooms at inspection and termination points?

YES

NO

N/A

199

GUIDE

Do you protect sensitive or critical systems by

using boxes at inspection and termination points?

YES

NO

N/A

200

GUIDE

Do you protect sensitive or critical systems by

using alternative routings or transmission media?

YES

NO

N/A

201

GUIDE

Do you protect sensitive or critical systems

by considering the use of fiber optic cables?

YES

NO

N/A

202

GUIDE

Do you protect sensitive or critical systems by

using physical inspections to detect the presence
of unauthorized cable monitoring devices?

YES

NO

N/A

203

GUIDE

Do you protect your sensitive or critical systems by

controlling access to patch panels and cable rooms?

YES

NO

N/A

204

GUIDE

Do you protect sensitive or critical cables by

using technical sweeps to detect the presence
of unauthorized cable monitoring devices?

YES

NO

N/A

205

GUIDE

Do you protect sensitive or critical cables

by using electromagnetic shielding?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 96

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

NOTES AND COMMENTS

9.2.4 MAINTAIN YOUR ORGANIZATIONS EQUIPMENT

206

CTRL

Do you maintain your equipment in order to protect its

integrity and to ensure that its available when you need it?

YES

NO

N/A

207

GUIDE

Do you follow the equipment manufacturers

recommended maintenance schedule?

YES

NO

N/A

208

GUIDE

Do you follow the equipment manufacturers

recommended maintenance specifications?

YES

NO

N/A

209

GUIDE

Do you allow only authorized maintenance

people to service and repair your equipment?

YES

NO

N/A

210

GUIDE

Do you keep a record of your organizations

preventive and corrective maintenance activities?

YES

NO

N/A

211

GUIDE

Do you keep a record of all equipment faults and problems?

YES

NO

N/A

212

GUIDE

Do you control on-site equipment maintenance and repair?

YES

NO

N/A

213

GUIDE

Do you control off-site equipment maintenance and repair?

YES

NO

N/A

214

GUIDE

Do you provide security clearance for maintenance personnel

or clear sensitive information from your equipment before
maintenance and repair activities are carried out?

YES

NO

N/A

215

GUIDE

Do you comply with the requirements that insurance polices

impose on your equipment maintenance and repair activities?

YES

NO

N/A

9.2.5 PROTECT YOUR OFF-SITE EQUIPMENT

216

CTRL

Do you use security measures to protect off-site equipment?

YES

NO

N/A

217

CTRL

Do your equipment security measures deal with the

range of risks that off-site equipment is exposed to?

YES

NO

N/A

218

GUIDE

Have you developed special security measures to address

your organizations unique or unusual off-site security risks?

YES

NO

N/A

219

GUIDE

Is management authorization required before any

information processing equipment can be removed
and used outside of your premises?

YES

NO

N/A

220

GUIDE

Do your personnel never leave information processing

equipment or media unattended in public places?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 97

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

221

GUIDE

Do personnel treat portable computers

as hand luggage while they are traveling?

YES

NO

N/A

222

GUIDE

Do your personnel conceal or disguise their

portable computers while they are traveling?

YES

NO

N/A

223

GUIDE

Do your personnel follow your equipment manufacturers

recommended security practices and precautions?

YES

NO

N/A

224

GUIDE

Do you protect equipment from strong electromagnetic fields?

YES

NO

N/A

225

GUIDE

Do you perform risk assessments in order to determine

what kinds of home-working security controls are required?

YES

NO

N/A

226

GUIDE

Have you developed special security measures

and controls for people who work at home?

YES

NO

N/A

227

GUIDE

Are suitable controls applied when personnel

use your equipment to work at home?

YES

NO

N/A

228

GUIDE

Do personnel use lockable filing cabinets when

they use your equipment to work at home?

YES

NO

N/A

229

GUIDE

Do personnel follow a clear desk policy when

they use your equipment to work at home?

YES

NO

N/A

230

GUIDE

Are computer access controls used when

personnel use your computers to work at home?

YES

NO

N/A

231

GUIDE

Are secure communications methods used when

communicating between the office and the home?

YES

NO

N/A

232

GUIDE

Does your organization have adequate insurance

coverage to protect its off-site equipment?

YES

NO

N/A

233

NOTE

Are security measures taken to control

the off-site use of mobile equipment?

YES

NO

N/A

234

NOTE

Are all appropriate security measures taken to

control the off-site use of personal computers?

YES

NO

N/A

235

NOTE

Are all appropriate security measures taken to

control the off-site use of personal organizers?

YES

NO

N/A

236

NOTE

Are all appropriate security measures taken to

control the off-site use of mobile phones?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

NOTES AND COMMENTS

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 98

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

237

NOTE

Are all appropriate security measures taken

to control the off-site use of smart cards?

YES

NO

N/A

238

NOTE

Are all appropriate security measures taken

to control the off-site use of paper documents?

YES

NO

N/A

NOTES AND COMMENTS

9.2.6 CONTROL EQUIPMENT DISPOSAL AND RE-USE

239

CTRL

Do you check all equipment containing storage media in

order to ensure that all sensitive data has been removed or
securely overwritten before you dispose of this equipment?

YES

NO

N/A

240

CTRL

Do you check all equipment containing storage media in

order to ensure that all licensed software has been removed
or securely overwritten before you dispose of this equipment?

YES

NO

N/A

241

GUIDE

Do you destroy data storage devices containing sensitive

information before you dispose of these devices?

YES

NO

N/A

242

GUIDE

Do you destroy, delete, or securely overwrite all sensitive

data before you allow anyone to re-use data storage devices?

YES

NO

N/A

243

GUIDE

Do you use techniques that ensure that the original data is

non-retrievable once it has been destroyed or overwritten?

YES

NO

N/A

244

NOTE

Do you use risk assessments to determine whether

damaged information storage devices should be
physically destroyed, discarded, or repaired?

YES

NO

N/A

9.2.7 CONTROL THE USE OF ASSETS OFF-SITE

245

CTRL

Do you ensure that your organizations assets

are not taken off-site without prior authorization?

YES

NO

N/A

246

CTRL

Do you ensure that your organizations equipment

is not taken off-site without prior authorization?

YES

NO

N/A

247

CTRL

Do you ensure that your organizations information

is not taken off-site without prior authorization?

YES

NO

N/A

248

CTRL

Do you ensure that your organizations software

is not taken off-site without prior authorization?

YES

NO

N/A

249

GUIDE

Have you identified employees who are authorized

to allow people to remove and use assets off-site?

YES

NO

N/A

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

EDITION 3.0

PAGE 99

ISO IEC 17799 2005 INFORMATION SECURITY AUDIT TOOL

9. PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

RESPONSES

250

GUIDE

Have you identified contractors who are authorized

to allow people to remove and use assets off-site?

YES

NO

N/A

251

GUIDE

Have you identified third-party users who are authorized

to allow people to remove and use your assets off-site?

YES

NO

N/A

252

GUIDE

Do you use time limits to control how long

people are allowed to use equipment off-site?

YES

NO

N/A

253

GUIDE

Do you check returns to ensure that people have complied

with the time limits placed on off-site equipment usage?

YES

NO

N/A

254

GUIDE

Do you record the off-site removal

and return of equipment?

YES

NO

N/A

255

NOTE

Do you use spot checks to detect

the unauthorized removal of assets?

YES

NO

N/A

256

NOTE

Do you use spot checks to detect

unauthorized recording devices?

YES

NO

N/A

257

NOTE

Do you use spot checks to detect

weapons and explosives?

YES

NO

N/A

258

NOTE

Do you make sure that spot checks comply with all

relevant legal, legislative, and regulatory requirements?

YES

NO

N/A

NOTES AND COMMENTS

Answer each of the above questions. Three answers are possible: YES, NO, and N/A. YES means youre in compliance,
NO means youre not in compliance, while N/A means that the question is not applicable in your case. Also, please use
the three columns on the right to assign remedial actions to people and to record the date the action was started
and the date it was finished. Please use these three columns to manage and control your remedial action process.
In the spaces below, enter the name and location of your organization, who completed this page, who reviewed it, and the dates.

ORGANIZATION:

YOUR LOCATION:

COMPLETED BY:

DATE COMPLETED:

REVIEWED BY:

DATE REVIEWED:

DEC 2005

COPYRIGHT 2005 BY PRAXIOM RESEARCH GROUP LIMITED. ALL RIGHTS RESERVED.

EDITION 3.0

PART 9

PHYSICAL & ENVIRONMENTAL SECURITY MANAGEMENT AUDIT

PAGE 100