INF.7 Office Workplace

Rooms used as offices MUST be suitable for this purpose. Office rooms MUST be selected and equipped in accordance with the protection needs or protection level of the information processed in such rooms. Office rooms that are open to the public MUST NOT be located in security-sensitive areas. Germany's regulation on workplaces (Arbeitsstättenverordnung) MUST be implemented for workplaces and the equipment of office rooms.

When employees leave their office rooms, all windows SHOULD be closed. If confidential information is located in an office room, the doors MUST be locked when leaving the room. This SHOULD be observed in particular in areas used by the public. The corresponding specifications SHOULD be included in suitable instructions. All employees SHOULD be required to comply with the instructions. In addition, regular checks MUST be carried out to ensure that the windows are closed when leaving an office room and, if necessary, that the doors are locked. Furthermore, it MUST be ensured that fire doors and smoke control doors are actually closed.

The power connections and network access points in an office room SHOULD be located in the same places as the IT devices used. Cabling routed over the floor SHOULD be covered by a cable duct.

All employees SHOULD have ergonomic workplaces. Above all, the monitors SHOULD be positioned to allow ergonomic and undisturbed working. Here, it SHOULD be ensured that screens are not exposed to unauthorised persons. Germany's occupational protection ordinance for working at screens (Bildschirmarbeitsschutzverordnung, BildscharbV) SHOULD be implemented. All workplaces SHOULD be individually adjustable to ensure problem-free IT operations.

All employees SHOULD be required to keep their workplaces tidy when they leave them. The employees SHOULD make sure that no confidential information can be viewed by unauthorised persons. All employees SHOULD carefully check their workplaces and ensure that no confidential information is freely accessible. Supervisors SHOULD check workplaces sporadically to ensure that no sensitive information is exposed.

Employees SHOULD be instructed to lock up confidential documents and storage media when they are not in use. To this end, suitable containers SHOULD be provided in or near office rooms.

If access to rooms cannot be limited in a suitable manner, anti-theft protection devices SHOULD be used for all IT systems. Anti-theft protection devices SHOULD also be used in areas frequented by the public.