ISMS Guides

A.7.9 Security of assets off-premises

: Andy Systems; ISMS Guides; 28 April 2023

A.7.9 Security of Assets Off-Premises would include:

Policy and Procedures: Documentation of policies and procedures outlining how assets are secured when taken off-premises, including laptops, mobile devices, portable storage media, or any other equipment containing sensitive information.
Asset Inventory: An up-to-date asset inventory that includes details of all assets that are allowed to be taken off-premises. This inventory should track the asset's owner, location, purpose, and any necessary security measures applied.
Asset Tracking and Accountability: Evidence of a system or process in place to track the movement of assets off-premises and ensure their accountability. This may involve check-in/check-out procedures or electronic tracking systems.
Encryption and Data Protection: Proof of encryption and data protection measures applied to sensitive information stored on assets taken off-premises. This is crucial to safeguard data in case of loss or theft.
Access Control: Documentation of access control measures implemented to restrict unauthorized access to off-premises assets. This may involve password protection, biometrics, or multi-factor authentication.
Physical Security Measures: Verification of physical security measures in place to protect assets during transit and at remote locations. This may include secure carrying cases, locks, or security seals.
Training and Awareness: Records of training and awareness programs provided to employees about the importance of safeguarding assets off-premises and the specific security measures to follow.
Incident Reports: Records of any security incidents related to assets taken off-premises, including the actions taken to mitigate the risks and prevent similar incidents in the future.
Compliance with Policies and Procedures: Confirmation that employees and users adhere to the established policies and procedures related to off-premises asset security.
Regular Audits and Reviews: Documentation of regular audits or reviews conducted to assess the effectiveness of off-premises asset security measures and identify areas for improvement.

By reviewing these pieces of evidence, an auditor can determine whether the organization has appropriate controls in place to secure assets when taken off-premises, mitigating the risk of loss, theft, or unauthorized access to sensitive information

A.7.8 Equipment siting and protection

: Andy Systems; ISMS Guides; 28 April 2023

A.7.8 Equipment Siting and Protection would include:

Physical Security Measures: Documentation and physical observations of security measures implemented to protect equipment from unauthorized access, tampering, theft, or damage. This may include locked server rooms, access control systems, surveillance cameras, and alarm systems.
Equipment Siting Policy: Evidence of a policy that outlines the requirements for the appropriate siting of equipment, taking into consideration factors such as environmental conditions, accessibility, and potential risks.
Risk Assessment: Records of risk assessments conducted to identify potential threats and vulnerabilities related to equipment siting and the corresponding mitigating controls put in place.
Secure Mounting: Verification that equipment, such as servers, routers, and switches, is securely mounted in designated locations to prevent accidental or intentional tampering.
Cable Management: Physical observations and documentation of cable management practices to ensure cables are organized, labeled, and protected to avoid accidental disconnection or damage.
Environmental Controls: Evidence of environmental controls in place to protect equipment from temperature, humidity, and other environmental factors that may affect its performance or longevity.
Redundancy and Backups: Documentation of redundancy measures and backup systems to ensure continuous operation of critical equipment in case of failures or disasters.
Maintenance and Monitoring: Records of regular equipment maintenance schedules and monitoring activities to identify potential issues or anomalies promptly.
Incident Reports: Records of any security incidents related to equipment siting or protection, along with the actions taken to address and prevent such incidents in the future.
Compliance with Standards: Confirmation that the organization follows relevant industry standards, best practices, and regulatory requirements related to equipment siting and protection.

By examining these pieces of evidence, an auditor can assess whether the organization has implemented effective measures to safeguard its equipment, ensuring the availability, integrity, and confidentiality of information systems and data.

A.7.7 Clear desk and clear screen

: Andy Systems; ISMS Guides; 28 April 2023

A.7.7 Clear Desk and Clear Screen would include:

Policy and Procedures: Documentation of clear desk and clear screen policies and procedures that outline the requirements for employees to maintain a tidy and secure workspace, ensuring that sensitive information is not left unattended on desks or screens.
Employee Training: Evidence of security awareness training provided to employees, specifically covering the importance of adhering to clear desk and clear screen policies and the potential risks associated with leaving sensitive information exposed.
Workstation Configuration: Physical observations and records of workstation configurations to verify compliance with clear desk and clear screen requirements, such as ensuring that employees lock their computers when not in use or enable screen savers with password protection.
Physical Inspections: Regular physical inspections of work areas to confirm that employees are following clear desk practices and not leaving sensitive documents or information visible to unauthorized individuals.
Incident Reports: Records of any security incidents related to clear desk and clear screen violations, along with the actions taken to address and prevent such incidents in the future.
Monitoring and Reporting: Documentation of monitoring mechanisms in place to track and report on compliance with clear desk and clear screen policies.
Disposal Procedures: Procedures for the secure disposal of sensitive information, ensuring that documents are shredded or securely discarded to prevent unauthorized access.
Clean Desk Audits: Internal audits or assessments conducted to evaluate the effectiveness of clear desk and clear screen practices within the organization.
Management Oversight: Evidence of management oversight and involvement in promoting and enforcing clear desk and clear screen policies.

By reviewing these pieces of evidence, an auditor can assess whether the organization has implemented appropriate measures to maintain a clean and secure working environment, reducing the risk of unauthorized access to sensitive information and enhancing overall information security.

CIMSNex User Guides

System Guides

A.7.9 Security of assets off-premises

A.7.9 Security of Assets Off-Premises would include:

A.7.8 Equipment siting and protection

A.7.8 Equipment Siting and Protection would include:

A.7.7 Clear desk and clear screen

A.7.7 Clear Desk and Clear Screen would include:

USER GUIDES

More Links

FEATURED STANDARDS

Search