INF.1 Generic Building

The protection for a building MUST be defined based on the (planned) use of a building and the protection needs of the business processes operated within it. In particular, security aspects regarding the protection of persons, commodities, and IT in the building MUST be taken into consideration, from fire prevention and electrical aspects to site access control. The security requirements from different areas MUST be coordinated.

Regular checks MUST be carried out to ensure that the protection and design of a building's circuits still meet the actual requirements at hand.

The current fire prevention regulations and the requirements imposed by the building inspectors MUST be met. The escape routes MUST be marked in accordance with the respective regulations and kept unobstructed. Regular checks MUST be carried out to determine whether the escape routes are usable and not blocked by any obstacles so that the building in question can be evacuated quickly in the event of a dangerous situation. The local fire department SHOULD be consulted when fire prevention plans are being developed. An IT-related fire prevention concept MUST be drawn up and implemented.

Unnecessary fire loads MUST be avoided.

Organisations MUST have a Fire Safety Officer or another person who is assigned the tasks involved. This person MUST be suitably trained.

Buildings MUST be equipped with a sufficient number of smoke detectors in accordance with the requirements in their construction permits and fire protection concepts. If a local alert at the location of each detector is not sufficient, all detectors MUST be connected to a fire alarm control panel (FACP). If smoke is detected a building, an alarm MUST be triggered. Everyone in the building MUST be able to hear it. The functioning of all smoke detectors and all other components of a fire alarm system MUST be checked regularly.

A sufficient number of suitably dimensioned hand-held fire extinguishers with the fire class required for the situation at hand (based on DIN EN 3, "Portable Fire Extinguishers") MUST be available for immediate firefighting measures. These hand-held fire extinguishers MUST be inspected and serviced regularly. Employees SHOULD be instructed in the use of the hand-held fire extinguishers. This instruction SHOULD be repeated at appropriate intervals.

Windows and doors accessible from the outside, such as from balconies or terraces, MUST be closed when a room is not occupied. Rooms MUST be locked if confidential information is left there. Corresponding instructions MUST be issued in this regard. All employees SHOULD be required to comply with the instructions. Regular checks MUST be carried out to ensure that windows and internal and external doors are locked after leaving a building. Fire and smoke doors MUST NOT be kept open for extended periods of time unless approved hold-open systems are used.

Access to areas of sensitive buildings and rooms MUST be governed by a policy and controlled. There SHOULD be a concept for site access control. The number of persons with site access authorisation SHOULD be reduced to the bare minimum for every area. Additional persons MUST not gain access until a corresponding need is confirmed. The site access authorisations granted SHOULD be documented. The site access control safeguards MUST be checked regularly for effectiveness.

Site access controls SHOULD also remain in place as far as possible during relocations.

Smoking MUST be prohibited in rooms where fires or contamination could cause considerable damage, such as server rooms or storage media and document archives. Regular checks MUST be carried out to ensure that site access protection is not circumvented when smoking areas are designated or tolerated.

When planning, erecting, and converting buildings and installing technical equipment, all the relevant standards and regulations MUST be taken into consideration.

There SHOULD be a security concept for a building's use. The security concept for the building SHOULD be adapted to the overall security concept of the respective organisation. It SHOULD be documented and updated at regular intervals.

Sensitive rooms or building areas SHOULD NOT be located in highly exposed or particularly hazardous areas.

There SHOULD be a lock-up plan for all keys to a given building. The manufacture, storage, management, and issue of keys SHOULD be organised in a centralised manner. Backup keys SHOULD be available and secured, but kept on hand for emergencies. Keys that have not been issued SHOULD be stored securely. Every key issued SHOULD be documented.

Rapid access to the distributors of all supply facilities within a building SHOULD be possible if and when required. Access to distributors SHOULD be restricted to a small group of authorised persons.

A lightning protection system SHOULD be installed according to the applicable standard. A comprehensive lightning and surge protection concept SHOULD be in place. At minimum, buildings with comprehensive IT equipment SHOULD be equipped with lightning protection devices of protection class II according to DIN EN 62305, “Lightning Protection”. The lightning protection system SHOULD be inspected and serviced regularly.

Up-to-date layout plans of all supply lines SHOULD be available for a given building. It SHOULD be specified who is responsible for maintaining and updating the layout plans of all supply lines. The plans SHOULD be stored in such a way that only authorised persons may access them, but they must be quickly accessible in case of need.

References to the locations of sensitive areas SHOULD be avoided. Sensitive areas of buildings SHOULD not be easily visible from the outside.

A building's structural smoke protection SHOULD be checked after installation and conversion work. Regular checks SHOULD be carried out to ensure that smoke protection components are still functioning.

On-site fire safety inspections SHOULD take place regularly, i.e. at least once or twice a year. Deficiencies identified during on-site fire safety inspections SHOULD be rectified immediately.

The Fire Safety Officer SHOULD be informed of work being performed on cable trays, hallways, and escape and rescue routes. They SHOULD check that fire safety measures are being implemented properly.

An alert plan for the measures to be taken in case of a fire SHOULD be drawn up. The alert plan SHOULD be reviewed and updated at regular intervals. Fire drills SHOULD be performed at regular intervals.

Adequate safeguards for burglary protection SHOULD be implemented and adapted to the local conditions at hand. Care SHOULD be taken during the planning, implementation, and operation of burglary protection to ensure that it is consistent, including in terms of its quality. It SHOULD be regularly inspected by a person with corresponding expertise. Employees SHOULD be aware of the regulations for burglary protection.

The documentation on a building (e.g. construction plans, route plans, wiring diagrams, escape route plans, fire department route maps) SHOULD always be kept up to date. It SHOULD be checked that all the relevant plans are still up to date and correct at least once every three years. Employees SHOULD be informed of any changes.

Doors and windows SHOULD be selected on the basis of the protection objectives of the area to be secured, the protection needs of the organisation in question, and the appropriate classification in line with the relevant standards. All the safeguarding measures meant to secure the windows, doors, and walls enclosing a given space SHOULD be appropriate and of equal quality with regard to burglary, fire and smoke. The proper functioning of safety doors and windows SHOULD be checked regularly.

Rooms with similar protection needs SHOULD be consolidated into zones in order to treat comparable risks in a uniform way and reduce the costs of required security safeguards.

All areas at risk of water damage SHOULD be equipped with an automatic drainage system. Regular checks SHOULD be performed to ensure that active and passive drainage systems still function.

When selecting or planning a building location, the environmental conditions that could influence information security SHOULD be checked. There SHOULD be an overview of the location-related threats at hand. These threats SHOULD be addressed by means of additional compensating safeguards.

The tasks of a gatekeeper or security service SHOULD be clearly documented. The gatekeeper SHOULD observe and monitor all movements of persons at the gate and at all other entrances in line with the respective organisation's security concept. All employees and visitors SHOULD be able to identify themselves to the gatekeepers. Visitors SHOULD be escorted to the person to be visited or collected from the entrance. The gatekeepers SHOULD be promptly informed of any changes in site access authorisations.

When selecting an appropriate building, it SHOULD be checked whether all the security requirements relevant for later use can be implemented. For every building, the existing threats and the safeguards required to prevent or reduce damage SHOULD be documented in advance.

Before moving out of a building, an organisation SHOULD draw up an inventory of all items relevant to information security for the move, such as hardware, software, storage media, files, or documents. Once the move is complete, all rooms SHOULD be checked for items left behind.

A firestop seal register SHOULD be maintained. This SHOULD record all the individual types of such partitions. After work is performed on firestop seals, the changes SHOULD be entered into the register within four weeks.

There SHOULD be an intruder and fire detection system appropriate for the rooms and risks at hand. The intruder and fire detection system SHOULD be inspected and serviced regularly. It MUST be ensured that the recipients of intrusion and fire detection alerts are capable of responding appropriately from both a technical and personnel-related perspective.

Depending on the protection needs and terrain at hand, a building SHOULD have perimeter protection. At minimum, the following components SHOULD be considered in terms of their usefulness and feasibility:

• a wall or fence around the property
• security safeguards against accidental trespassing (crossing the property line)
• security safeguards against deliberate trespassing without the use of force
• safeguards to impede the deliberate crossing of the property line through force
• open-air security safeguards
• person and vehicle detection
• safeguards for preserving evidence (e.g. video recording)
• automatic alerts