+INF.2.A6 Site Access Control [Building Services] (B)

INF.2.A6 Site Access Control [Building Services] (B)

Access to a data centre MUST be controlled. Site access rights MUST be assigned in accordance with the specifications of module ORP.4 Identity and Access Management. It MUST be ensured that those who work at a data centre do not have access to IT systems outside their scope of work.

All the possible ways to access a data centre MUST be equipped with site access control devices. Each instance in which a person accesses a data centre MUST be individually recorded by a site access control system. In the case of a server room, it SHOULD be checked whether it is appropriate to monitor all the possible ways to access the site in question.

Regular checks MUST be carried out to determine whether the regulations regarding the use of site access controls are being observed.

An organisation's requirements regarding its site access control system MUST be documented in a concept with a sufficient level of detail.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.16 Theft of Devices, Storage Media and Documents
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.44 Unauthorised Entry to Premises