The cybersecurity architecture should comply with the NIST Framework Core. It must offer protection for the confidentiality, integrity and availability of data, services and systems. An implementation plan should be drawn up for the cybersecurity architecture. This should be designed with the specific corporate culture and the business’s strategic objectives in mind, but at the same time pay appropriate heed to the need for security, and the resources that this requires. The cybersecurity architecture is generally accompanied by an integrated task list which identifies expected outcomes (indications and triggers for further review and orientation), determines project timelines, supplies estimates of the required resources, and pinpoints significant project dependencies. To meet the requirements for information security, physical assets, including systems and network equipment, office equipment (e.g. network printers and multifunction devices), as well as special equipment (e.g. industrial control systems) must be protected for their entire life cycle, from acquisition (purchase or lease), through maintenance, to their disposal. Mobile devices (including laptops, tablets and smartphones) and their data must also be protected against unauthorised access, loss and theft, by configuring their security settings appropriately, limiting access to them, installing security software, and managing all devices centrally. 1.6.8 Hardware life cycle management 1.6.7 Physical security Physical security measures reduced the risk of accidental or deliberate loss or damage to ICT assets belonging to the organisation or the surrounding environment. The assets to be protected include physical assets such as tools and plant equipment, the environment, the surrounding community and intellectual property, including proprietary data, such as process settings and customer information. In many cases, physical security controls must meet specific environmental, safety, regulatory, legal and other requirements. Organisations should tailor physical security controls, such as technical controls, to the type of protection needed. To ensure comprehensive defences, physical protection also covers the security of ICT components and data from the surrounding environment which is connected with the ICT. With many ICT infrastructures, security is closely linked to plant safety. This is to keep employees out of dangerous situations, without obstructing them in their work, or emergency procedures. Physical security controls are both active and passive measures which limit physical access to all elements of the ICT infrastructure. Below are a few examples of the incidents that such defences are intended to prevent: • Unauthorised physical access to sensitive locations • Physical modification, manipulation, theft or other removal or destruction of existing systems, infrastructure, communications interfaces or physical locations • Unauthorised observation of sensitive facilities through visual observation, photographs, or any other means of recording information • The unauthorised introduction or installation of new systems, infrastructure, communications interfaces or other hardware • The unauthorised introduction of devices (USB sticks, wireless access points, bluetooth or mobile devices) designed to manipulate hardware, listen in on communications, or have any other damaging effect. The acquisition (purchase or lease) of durable, reliable hardware should always conform to security requirements. Possible vulnerabilities in the hardware should always be identified. The aim is to ensure that the hardware always offers the required level of functionality, and does not impair the security of critical or sensitive information and systems for the whole of its life cycle. 1.6.9 Mobile device configuration To protect data from unauthorised access, loss and theft, mobile devices (including laptops, tablets and smartphones) should always have a standard configuration which confirms to the security requirements. The aim of this standard configuration is to guarantee the information security of stored or transmitted data on the mobile device, even if it is lost or stolen. 1.6.10 Industrial control systems Industrial control systems must be monitored and controlled in accordance with the level of protection that they require. These systems demand particular technological and physical protection, specifically in order to guarantee that supply-related processes continue to run. Minimum ICT standard 2018 10