Protection Level Baseline (All Mandatory) • All Minimal Controls Medium & High Controls • All Baseline Controls • Physically sound walls with no gaps in the perimeter. • Slab-to-slab wall construction to separate zones; Metal or solid wood core, minimum of 44.45 mm • Manned reception area or other means to control thick physical access • Information Processing Facilities are physically separated from those managed by third parties • Visual evidence of unauthorized penetration • Floor to ceiling wall construction • External protection for Windows • Intruder Detection System installed to cover all external doors and accessible windows • All Minimal Controls • All Baseline Controls • Electronic locks on zone entrances (card/token only) • Electronic locks on zone entrances (token and PIN or biometric) • Audit trail (date & time) records for access points only • Perimeter doors resistant to forced entry • All visitors supervised; access for specific purpose • Visible identification for all employees, contractors, and third parties including visitors • Audit trail (date & time) records for all access (including access to safes, etc.) • Primary entrance and access controlled interior doors must be equipped with an automatic door closer • Metal detectors • Third party/contactors granted restricted access to secure areas or sensitive processing facilities • X-ray examination • Locks that resist easy picking or prying open • Barriers to prevent access if opening of ducts, vents, pipes, etc. is > 619 square centimetres • Additional physically controlled barriers • Use of safes/vaults • All Minimal Controls • All Baseline Controls • Facilities should be sited to avoid public access • Windows that might reasonably afford visual surveillance should be made opaque or equipped with coverings • Buildings should not give obvious signs of their purpose or identify the presence of information processing facilities • Facilities should not be accessible by the public • Clean desk policy • All Minimal Controls • All Baseline Controls • Fallback equipment and back-up data are outside of zone • Sound Transmission Class (STC) rating of 45 or better between zones • Hazardous or combustible materials stored at a safe distance from zone 49 NATIONAL INFORMATION ASSURANCE MANUAL