48. Does the datacenter or main computer room have a sign-in procedure that is 49. 50. 51. 52. 53. 54. 55. 56. 57. 58. 59. used to record non-employees into the restricted space? Are data centres, data rooms and data cabinets protected by adequate fire and burglary detectors and or CCTV and or fire suppression systems commensurate with the cost of the loss of the equipment, data or records? Is there sufficient heating and cooling to the datacenter/computer room to maintain a consistent safe operating temperature for the electronic equipment? Is the electronic equipment protected from moisture or excessive humidity, dust, smoke, chemical fumes or other potentially damaging substances? Is there a risk of water entry to any area housing critical equipment or records from water pipes, hot water systems, waste pipes, storm water pipes, box gutters or sprinkler systems? Is physical access to the console interfaces of security systems such as those used to manage firewalls, CCTV and intrusion systems, restricted to authorised users? Do you ensure users have anti-virus software loaded and active on systems? Are documents that contain sensitive information secured or otherwise protected from unauthorised printing? Does the company have a documented and enforced procedure for the safe disposal of paper records that are no longer required? Is waste paper binned or shredded? Are there sufficiently rigorous policies and procedures governing the use of removable magnetic media, such as USB devices? Are there sufficiently rigorous procedures to restrict unauthorised access to back-up media? Power Supply 60. Are all important pieces of equipment protected with surge protectors and 61. 62. 63. 64. 65. uninterruptable power supplies? Are electrical supply components, such as fuse boxes, protected from unauthorized access? If the systems are sufficiently critical to the organisation, are they connected to a dual source of electricity? Is there an adequate back-up generator, protected with security devices such as locks alarms and if located outside a building, fences and barbed wire? Does any back-up generator have ample fuel for a reasonably lengthy power outage, at least long enough to source further supplies? Does the back-up generator have an automatic switch over when the power goes off and back the other way when the public supply is returned? Security of Access Ports & Communication Lines 66. Are unused network or telecommunication access points physically disabled to prevent unauthorised access? 67. Where the network and telecommunications ports are not disabled are there procedures to monitor for unauthorised access to these ports? 68. Are there physical barriers to protect the network cables running to and from the equipment to reduce accidental or deliberate damage? Training on Security Procedures 69. Are all staff provided with periodic training on the organisations security policies with explanation as to why the policies are important and compliance will be enforced? 70. Are employees trained/warned on the importance of keeping watch and or securing laptops and other portable information devices when taking them outside the workplace? 71. Are employees trained to use ‘strong’ passwords and not to base passwords on biographical details that may be publically available? ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐