a) power and telecommunications lines into information processing facilities should be underground, where possible, or subject to adequate alternative protection; b) power cables should be segregated from communications cables to prevent interference; c) for sensitive or critical systems further controls to consider include: 1) installation of armored conduit and locked rooms or boxes at inspection and termination points; 2) use of electromagnetic shielding to protect the cables; 3) initiation of technical sweeps and physical inspections for unauthorized devices being attached to the cables; 4) controlled access to patch panels and cable rooms. (NL ISO/IEC, 2015) 11.4. Equipment Maintenance Equipment should be correctly maintained to ensure its continued availability and integrity. The following guidelines for equipment maintenance should be considered: a) equipment should be maintained in accordance with the supplier’s recommended service intervals and specifications; b) only authorized maintenance personnel should carry out repairs and service equipment; c) records should be kept of all suspected or actual faults, and of all preventive and corrective maintenance; d) appropriate controls should be implemented when equipment is scheduled for maintenance, taking into account whether this maintenance is performed by personnel on site or external to the organization; where necessary, confidential information should be cleared from the equipment or the maintenance personnel should be sufficiently cleared; e) all maintenance requirements imposed by insurance policies should be complied with; f) before putting equipment back into operation after its maintenance, it should be inspected to ensure that the equipment has not been tampered with and does not malfunction. (NL ISO/IEC, 2015) 11.5. Removal of Assets Equipment, information or software should not be taken off-site without prior authorization. The following guidelines should be considered: a) employees and external party users who have authority to permit off-site removal of assets should be identified; b) time limits for asset removal should be set and returns verified for compliance; Lebanese National Security Policy Guidelines v1.7 Page 38 |