13.2.2 For that purpose, the relevant entities shall, where appropriate: (a) design and implement …

Requirement

For that purpose, the relevant entities shall, where appropriate:

(a) design and implement protection measures against physical and environmental threats;

(b) determine minimum and maximum control thresholds for physical and environmental threats;

(c) monitor environmental parameters and report to the competent internal or external personnel events outside the minimum and maximum control thresholds referred to in point (b).

Guidance

• Implement measures against physical and environmental threats. Parameters to consider are (indicative, non-exhaustive list):
  • purpose and scope;
  • network and information systems in scope;
  • description of facilities;
  • roles and responsibilities;
  • management commitment;
  • coordination among organisational units;
  • compliance with national and EU law, including personal data protection.
• Consider potential physical and environmental threats relevant to the context, location and operational environment. The following list offers examples (indicative and non-exhaustive) to support risk-based planning:
  • fire, flood or natural events (e.g. earthquakes, storms),
  • public disturbances or unauthorized access, theft or vandalism,
  • hazardous material incidents (e.g. chemical spills),
  • long-term environmental changes (e.g. climate trends, air quality).
• Consider measures against physical and environmental threats such as (indicative, non-exhaustive list):
  • physical access control measures (e.g. IDs, badges, logs; visitor management system and physical barriers);
  • surveillance systems (e.g. CCTV, entry points, exits, locking mechanisms and security personnel);
  • climate control (e.g. temperature and humidity controls and HVAC systems);
  • fire prevention and response measures (e.g. fire alarms, smoke detectors, sprinkler systems and fire extinguishers);
• Consider enhanced (maximum) measures to be activated during heightened threat levels or specific scenarios. Examples of such measures include (indicative, non-exhaustive list):
  • Increased security personnel, advanced biometric access controls and lockdown procedures.
  • Enhanced monitoring systems, redundant power supplies and advanced environmental sensors.

Examples of evidence

• Detailed documentation showing the design and implementation of measures against physical and environmental threats.
• Reports outlining the defined minimum and maximum control thresholds for various threats.
• Logs from environmental monitoring systems showing continuous tracking of parameters, such as temperature, humidity and security breaches.
• Records of incidents where parameters fell outside the defined thresholds, including the actions taken and notifications sent to relevant personnel.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -