POLICY STATEMENT

This policy is intended to institute standards for granting, monitoring, and terminating physical access to ITC services and to protect ITC equipment from environmental factors.

BACKGROUND AND JUSTIFICATION

Environmental Safeguards

1. Air conditioning should be operational in ITC Data Center.
2. All ITC facilities should have adequate fire extinguishing devices. These devices should be inspected regularly.
3. Critical ITC resources must be connected to an Uninterrupted Power Supply (UPS) to maintain steady power source to prevent spikes and brownouts, which might damage data and Hardware.
4. Electrical outlets should not be burdened with too many devices to insure practical usage of extension cords.

Physical Access

1. Physical access privileges to all ITC facilities must be issued, managed, and documented by ITC.
2. All ITC facilities should be physically protected.
3. Only authorized PSU staff and faculty members are allowed to access ITC facilities.
4. Granting fingerprint access to ITC facilities should be approved by CITO.
5. All ITC facilitates must be kept locked when not used to reduce the occurrence of unauthorized entry and access

SCOPE AND PURPOSE

This policy relates to all ITC facilities including but not limited to meeting rooms, presentation rooms, network closets, and the ITC Data and Operation Centers.

PRINCIPLES OF THE POLICY

1. Layered Security: Physical security will be approached with multiple layers, from the perimeter to data centers, ensuring redundancy and minimizing vulnerabilities.
2. Access Control: Only authorized personnel will have access to IT facilities. Entry and exit points will be controlled and monitored to prevent unauthorized access.
3. Asset Management: All IT physical assets, from servers to mobile devices, will be inventoried and regularly audited to ensure their security.
4. Surveillance: Strategic areas, such as server rooms, will be under continuous surveillance using tools like CCTV to deter and detect threats.
5. Environmental Safeguards: IT facilities will have controls against environmental hazards, such as fire, floods, and electrical outages, ensuring continuous operation and data integrity.
6. Training and Awareness: All staff will receive regular training on the importance of physical security and their role in maintaining it.
7. Visitor Management: All visitors to IT-specific areas will be logged, monitored, and possibly escorted, minimizing potential security risks.
8. Incident Response: Procedures will be in place for immediate action in the event of a physical security breach, including communication protocols and recovery strategies.
9. Continuous Improvement: The policy will be reviewed periodically, and measures will be updated based on new threats, technological advancements, and feedback.
10. Compliance with Regulations: All physical security measures will adhere to relevant local, national, and international regulations to ensure compliance and standardization.

DEFINITIONS

1. Physical Security: Measures and controls to protect IT assets from physical threats, including unauthorized access, theft, and environmental disasters.
2. Access Control: Mechanisms to grant or deny individuals' entry into specific areas based on their authorization levels.
3. Asset Management: The systematic process of maintaining, upgrading, and managing physical IT assets, such as servers, workstations, and networking equipment.
4. Surveillance: Continuous or periodic observation of IT facilities to prevent, detect, and respond to security breaches.
5. Environmental Controls: Systems in place to manage environmental factors, such as temperature, humidity, and fire, ensuring optimal operation and protection of IT assets.
6. Visitor Log: A record of all non-staff individuals who enter IT-specific areas, including their name, purpose of visit, entry, and exit times.
7. Incident: Any event that compromises, or has the potential to compromise, the physical security of IT assets.
8. Perimeter Security:: Measures taken at the outermost boundary of an IT facility to prevent unauthorized entry. This includes fences, gates, and guards.
9. Restricted Area: A designated space with stringent access controls, usually housing critical IT infrastructure.
10. Authentication Mechanisms: Tools or methods used to verify the identity of individuals seeking access, such as badges, biometrics, and PINs.

RESPONSIBILITIES AND IMPLEMENTATION STRATEGIES

1. Facility Design & Management:
   1. Ensure facilities housing IT equipment are designed with security in mind.
   2. Utilize barriers, such as walls or fences, to protect against unauthorized access.
2. Access Control Measures:
   1. Implement key card access, biometric verification, or other access control systems.
   2. Regularly review and update access permissions, ensuring only authorized personnel can access critical areas.
3. Asset Tracking & Management:
   1. Maintain a current inventory of all IT assets.
   2. Deploy tracking systems, such as RFID tags, for high-value items.
4. Surveillance & Monitoring:
   1. Install and maintain surveillance cameras at strategic points.
   2. Regularly review footage, especially after reported or suspected incidents.
5. Environmental Control Implementation:
   1. Install fire suppression systems, uninterrupted power supplies, and climate control in critical IT areas.
   2. Conduct periodic checks to ensure all systems are functional.
6. Training & Awareness Programs:
   1. Provide training for staff on their role in physical security, from tailgating prevention to emergency evacuation procedures.
   2. Update training content to address new threats or challenges.
7. Visitor Management Protocols:
   1. Ensure all visitors to sensitive IT areas are logged, provided with visitor badges, and possibly escorted.
   2. Limit the duration and scope of their visits to necessary activities.
8. Incident Response Preparedness:
   1. Establish and regularly review protocols for responding to physical security incidents.
   2. Conduct drills or simulations to ensure staff readiness.
9. Regular Audits & Assessments:
   1. Periodically evaluate the effectiveness of physical security measures.
   2. Address identified vulnerabilities promptly.
10. Collaboration with Relevant Entities:
    1. Build relationships with local law enforcement and emergency response teams.
    2. Share relevant information about potential threats and seek guidance on best practices.

RESPONSIBILITIES AND IMPLEMENTATION STRATEGIES

Any violation of this policy will make the subject susceptible disciplinary actions. with the Enforcement section of the ITC Unauthorized Use Policy.

https://www.psu.edu.sa/en/IT0002-unauthorized-use-policy

REFERENCES:

https://www.psu.edu.sa/en/cop005-disciplinary-policy