13.3.2 For that purpose, the relevant entities shall: (a) on the basis of the risk assessment carried out …

Requirement

For that purpose, the relevant entities shall: (a) on the basis of the risk assessment carried out pursuant to point 2.1, lay down and use security perimeters to protect areas where network and information systems and other associated assets are located; (b) protect the areas referred to in point (a) by appropriate entry controls and access points; (c) design and implement physical security for offices, rooms and facilities, (d) continuously monitor their premises for unauthorised physical access.

Guidance

• In the risk assessment, consider risks associated with unauthorised physical access to, damage to and interference with network and information systems.
• Based on the results of the risk assessment, determine high-criticality assets and the impact of their being compromised. This will help in identifying the perimeter for such assets.
• Prevent unauthorised physical access to facilities and set up adequate measures.
  • Physical access control measures designed to protect the entity as a whole will also protect individual assets.
  • Consider introducing further specific access control measures for specific assets or facilities.
• Consider physical security measures (indicative, non-exhaustive list):
  • physical access controls such as key cards, biometric scanners, locks and security personnel to restrict access to high-criticality areas,
  • electronic control of entry, with an audit trail,
  • segmentation of spaces or creation of zones according to authorization levels and their contents,
  • CCTV cameras and monitoring systems to continuously observe sensitive areas,
  • fencing, barriers and security patrols for securing physical perimeters,
  • guards and/or alarms to monitor every physical access point to the facility where the information system resides, 24 hours per day, seven days per week.
• Develop and enforce procedures for granting, reviewing and revoking physical access rights (section 11.2).
  • Identify a designated official within the entity to review and approve the list of personnel with authorized physical access.
  • Maintain a list of personnel with authorized access to facilities, and their authorization levels.

Examples of evidence

• Risk assessment results
• Existence of physical security measures
• Procedures for granting, reviewing and revoking physical access rights in accordance with point 11.2 in the Annex to the regulation.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• ENISA -