South Plains College

Information Services (SPC-IS)

 

Physical and Environmental Protection Policy: I-H

 

Purpose

To ensure that South Plain College Information Technology (IT) resources are protected by physical and environmental security measures that prevent physical tampering, damage, theft, or unauthorized physical access.

 

Policy

This policy applies to all information technology systems facilities, including MDF, IDF, Cable trays, computer centers, and users who access information technology infrastructure facilities.

 

1. Physical Access Authorizations

SPC-IS Department shall:

 

1. Develop, approve, and maintain a list of individuals with authorized access to the facilities where the information systems reside.

 

1. Issue authorization credentials for facility access.

 

1. Review the access list detailing authorized facility access by individuals and remove individuals from the facility access list when access is no longer required.

 

1. Physical Access Control

SPC-IS Department shall:

 

1. Enforce physical access authorizations by verifying individual access authorizations before granting access to the facility.

 

1. Control ingress/egress to the facility using keyless entry fobs, cards, or keys.

 

1. Maintain physical access audit logs for MDF, IDF, and computer centers.

 

1. Provide keyless entry fobs, cards, or keys to control access to areas within the facility officially designated as publicly accessible.

 

1. Escort visitors and monitor visitor activity in MDF, IDF, and Data Centers.

 

1. Secure keys, combinations, and other physical access devices.

 

1. Inventory fobs, cards, and keys every quarter.

 

1. Change combinations and keys when keys are lost, combinations are compromised, or individuals are transferred or terminated.

 

1. Facility Penetration Testing

SPC-IS Department shall:

 

1. Employ a penetration testing process that includes quarterly unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility.

 

1. Access Control For Transmission Medium

SPC-IS Department shall:

 

1. Control physical access to MDF, IDF, cable trays, and Fiber Handholds within SPC facilities using keyless entry cards of fobs or keys

 

1. Monitoring Physical Access

SPC-IS Department shall:

 

1. Monitor physical access to the information system's facility to detect and respond to physical security incidents.

 

1. Review physical access logs upon the occurrence of unauthorized access and coordinate results of reviews and investigations with the organizational incident response capability.

 

1. Visitor Access Records

SPC-IS Department shall:

 

1. Maintain visitor access records for one year at the facility where the information system resides; review visitor access records quarterly.

 

 

1. Power Equipment and Cabling

SPC-IS Department shall:

 

1. Protect the information system's power equipment and cabling from damage and destruction.

 

1. Determine the types of protection necessary for power equipment and cabling employed at different locations, both internal and external, for organizational facilities and operating environments. This includes, for example, generators and power cabling outside buildings, internal cabling, uninterruptable power sources within an office or data center, and power sources for self-contained entities such as vehicles and satellites.

 

1. Ensure generators are run-tested on a regular schedule. The test should verify that the generators are outputting the required power, starting promptly, and shutting off as required.

 

1. Emergency Shutoff

SPC-IS Department shall:

 

1. Provide the capability of shutting off power to the information system or individual system components in emergencies.

 

1. Place emergency shutoff switches or devices in to facilitate safe and easy access for personnel and protect emergency power shutoff capability from unauthorized activation.

 

1. Emergency Power

SPC-IS Department shall:

 

1. Provide a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system and transition of the information system to long-term alternate power in the event of a primary power source loss.

 

1. Provide a long-term alternate power supply for the information system that can maintain minimally required operational capability in the event of an extended loss of the primary power source.

 

1. Emergency Lighting

SPC-IS Department shall:

 

1. Employ and maintain automatic emergency lighting for the information system that activates during a power outage or disruption and covers emergency exits and evacuation routes within the facility.

 

1. Provide emergency lighting for all areas within the facility supporting essential missions and business functions.

 

1. Fire Protection

SPC-IS Department shall:

 

1. Employ and maintain fire suppression and detection devices/systems for the information system supported by an independent energy source.

 

This applies primarily to facilities containing concentrations of information system resources such as computer centers. Fire suppression and detection devices/systems include sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors.

 

1. Temperature And Humidity Controls

SPC-IS Department shall:

 

1. Maintain temperature and humidity levels within the information system's facility.

 

1. Monitor temperature and humidity levels to include alarms or notifications of changes potentially harmful to personnel or equipment.

 

1. Water Damage Protection

SPC-IS Department shall:

 

1. Protect the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working correctly, and known to key personnel.

 

This applies primarily to facilities containing concentrations of information system resources such as computer centers. Isolation valves can be employed in addition to or instead of master shutoff valves to shut off water supplies in specific areas of concern without affecting entire organizations.

 

1. Delivery And Removal

SPC-IS Department shall:

 

1. Authorize, monitor, and control entering and exiting the facility and maintain records of those items delivered and removed from the facility.

 

Effectively enforcing authorizations for the entry and exit of information system components may require restricting access to delivery areas and possibly isolating the areas from the information system and media libraries.

 

1. Alternate Work Site

SPC-IS Department shall:

 

1. Employ key access at alternate work sites.

 

1. Assess the effectiveness of security controls at alternate work sites as feasible.

 

1. Provide a means for employees to communicate with information security personnel in case of security incidents or problems.

 

Alternate work sites may include, for example, other SPC facilities or employees' private residences. While commonly distinct from alternative processing sites, alternate work sites may provide readily available alternate locations for contingency operations. Staff may define different sets of security controls for specific alternate work sites or types of sites depending on the work-related activities conducted at those sites.

 

Compliance

Employees who violate this policy may be subject to appropriate disciplinary action, including discharge and civil and criminal penalties. Non-employees, including, without limitation, contractors, may be subject to termination of contractual agreements, denial of access to IT resources, and other actions, as well as both civil and criminal penalties.

 

Policy Exceptions

Requests for exceptions to this policy shall be reviewed by the Information Security Officer (ISO) and the Chief Information Officer (CIO). Departments requesting exceptions shall provide such requests to the CIO. The request should expressly state the scope of the exception along with justification for granting the exception, the potential impact or risk attendant upon granting the exception, risk mitigation measures to be undertaken by the IT Department, initiatives, actions, and a time frame for achieving the minimum compliance level with the policies set forth herein. The CIO shall review such requests and confer with the requesting department.

 

Related Documents

1 TAC § 202.74 (a)(2)

 

National Institute of Standards and Technology (NIST) Special Publications (SP): NIST SP 800-53a – Physical and Environmental Protection (PE), NIST SP 800-46, NIST SP 800-73, SP NIST 800-76, SP NIST 800-78, SP NIST 800-116; Intelligence Community Directive (ICD): 704 705; Department of Defense (DoD): Instruction 5200.39 Critical Program Information (CPI) Protection; Federal Identity, Credential, and Access Management (FICAM) publication: Personal Identity Verification (PIV) in Enterprise Access Control System (E-PACS) (2012)

 

Texas Security Controls Standards Catalog Control Group: CM-5, PE-1, PE-2, PE-3, PE-6, PS-5

 

NIST Function Groups: PR.AT-1