Protection Level Baseline (All Mandatory) • Unsupervised working should be avoided Medium & High Controls • All Baseline Controls • Vacant secure areas are physically locked and periodically checked • Photographic, video, audio or other recording equipment not allowed, unless explicitly authorised. • Visual indication when visitors are present in any secure zone. • All Minimal Controls • All Baseline Controls • Incoming and outgoing shipments are physically segregated. • Access restricted to people / vehicles whose identification papers have been verified. • Access restricted to personnel / vehicles by prior appointment. • Vehicles are checked for suspect devices. • All Minimal Controls • All Baseline Controls • Controls to minimise risk of potential physical threats e.g. theft, fire, explosives, smoke, water, dust, vibration, chemical effects, electrical supply interference, communications interference, electromagnetic radiation and vandalism • Items requiring special protection should be isolated and appropriately protected • Equipment processing sensitive information should be protected to minimise the risk of information leakage due to emanation. • Temperature & humidity should be monitored in all Information Processing facilities (e.g. server rooms, etc.) • All Minimal Controls • All Baseline Controls • An Uninterruptible Power Supply (UPS) for all critical systems should be installed and regularly tested. • A backup generator for all critical systems should be installed and regularly tested. • Water supply failure should generate an alarm • Telecoms equipment should be connected by at least two diverse routes to prevent single points of failure. • All Minimal Controls • All Baseline Controls • Power cables should be segregated from communications cables • Armoured conduit and locked rooms or boxes at inspection/termination points. • Clearly identifiable cable and equipment markings should be used. • Use fibre optic cabling • A documented patch list should be maintained • Initiate technical sweeps and physical inspections for detecting unauthorised devices • Access to patch panels and cable rooms must be restricted to authorised personnel 51 NATIONAL INFORMATION ASSURANCE MANUAL • Use electromagnetic shielding to protect cables