School of Visual Arts is hereinafter referred to as “the company.”

1.0 Overview

Information assets are necessarily associated with the physical devices on which they reside.  Information is stored on workstations and servers and transmitted on the company’s physical network infrastructure.  In order to secure the company data, thought must be given to the security of the company’s physical Information Technology (IT) resources to ensure that they are protected from standard risks.


2.0 Purpose

The purpose of this policy is to protect the company’s physical information systems by setting standards for secure operations.


3.0 Scope

This policy applies to the physical security of the company’s information systems, including, but not limited to, all company-owned or company-provided network devices, servers, personal computers, mobile devices, and storage media.  Additionally, any person working in or visiting the company’s office is covered by this policy. 

Please note that this policy covers the physical security of the company’s Information Technology infrastructure, and does not cover the security of non-IT items or the important topic of employee security.  While there will always be overlap, care must taken to ensure that this policy is consistent with any existing physical security policies.


4.0 Policy

4.1 Choosing a Site
When possible, thought should be given to selecting a site for IT Operations that is secure and free of unnecessary environmental challenges.  This is especially true when selecting a datacenter or a site for centralized IT operations.  At a minimum, the company’s site should meet the following criteria:

•           A site should not be particularly susceptible to fire, flood, earthquake, or other natural disasters.

•           A site should not be located in an area where the crime rate and/or risk of theft is higher than average.

•           A site should have the fewest number of entry points possible.

If these criteria cannot be effectively met for any reason, the company should consider outsourcing its data in whole or in part to a third-party datacenter or hosting provider, provided that such a company can cost effectively meet or exceed the company’s requirements.


4.2 Security Zones
At a minimum, the company will maintain standard security controls, such as locks on exterior doors and/or an alarm system, to secure the company’s assets.  In addition to this the company must provide security in layers by designating different security zones within the building.  Security zones should include:

Public This includes areas of the building or office that are intended for public access.

•           Access Restrictions: None

•           Additional Security Controls: None

•           Examples: Lobby, common areas of building

Company This includes areas of the building or office that are used only by employees and other persons for official company business.

•           Access Restrictions: Only company personnel and approved/escorted guests

•           Additional Security Controls: Additional access controls should be used, such as keys, keypads, keycards, or similar devices, with access to these areas logged if possible.

•           Examples: Hallways, private offices, work areas, conference rooms

Private This includes areas that are restricted to use by certain persons within the company, such as executives, scientists, engineers, and IT personnel, for security or safety reasons.

•           Access Restrictions: Only specifically approved personnel

•           Additional Security Controls: Additional access controls must be used, such as keys, keypads, keycards, or similar devices, with access to these areas logged.  Additionally, an alarm system should be considered for these areas that will alert to unauthorized access.

•           Examples: Executive offices, lab space, network room, manufacturing area, financial offices, and storage areas.


4.3 Access Controls
Access controls are necessary to restrict entry to the company premises and security zones to only approved persons.  There are a several standard ways to do this, which are outlined in this section, along with the company’s guidelines for their use.


4.3.1 Keys & Keypads
The use of keys and keypads is acceptable, as long as keys are marked “do not duplicate” and their distribution is limited.  These security mechanisms are the most inexpensive and are the most familiar to users.  The disadvantage is that the company has no control, aside from changing the locks or codes, over how and when the access is used.  Keys can be copied and keypad codes can be shared or seen during input.  However, used in conjunction with another security strategy, such as an alarm system, good security can be obtained with keys and keypads.


4.3.2 Keycards & Biometrics
The company requires that keycards or biometrics be used for access to security zones designated as private.  The company should consider using these methods for all zones, though it is not required.

Keycards and biometrics have an advantage over keys in that access policies can be tuned to the individual user.  Schedules can be set to forbid off-hours access, or forbid users from accessing a security zone where they are not authorized.  Perhaps best of all, these methods allow for control over exactly who possesses the credentials.  If a keycard is lost or stolen it can be immediately disabled.  If an employee is terminated or resigns, that user’s access can be disabled.  The granular control offered by keycards and biometrics make them appealing access control methods.


4.3.3 Alarm System
A security alarm system is a good way to minimize risk of theft, or reduce loss in the event of a theft.  The company does not mandate the use of an alarm system, however an alarm system would be an excellent way to increase the security of the site.


4.4 Physical Data Security
Certain physical precautions must be taken to ensure the integrity of the company’s data.  At a minimum, the following guidelines must be followed:

•           Computer screens should be positioned where information on the screens cannot be seen by outsiders. 

•           Confidential and sensitive information should not be displayed on a computer screen where the screen can be viewed by those not authorized to view the information.

•           Users must log off or shut down their workstations when leaving for an extended time period, or at the end of the workday.

•           Network cabling should not run through unsecured areas unless the cabling is carrying only public data (i.e., extended wiring for an Internet circuit).

•           The company recommends disabling network ports that are not in use.


4.5 Physical System Security
In addition to protecting the data on the company’s information technology assets, this policy provides the guidelines below on keeping the systems themselves secure from damage or theft.


4.5.1 Minimizing Risk of Loss and Theft
In order to minimize the risk of data loss through loss or theft of company property, the following guidelines must be followed:

•           Unused systems: If a system is not in use for an extended period of time it should be moved to a secure area or otherwise secured.

•           Mobile devices: Special precautions must be taken to prevent loss or theft of mobile devices.  Refer to the company’s Mobile Device Policy for guidance.

•           Systems that store confidential data: Special precautions must be taken to prevent loss or theft of these systems.  Refer to the company’s Confidential Data Policy for guidance.


4.5.2 Minimizing Risk of Damage
Systems that store company data are often sensitive electronic devices that are susceptible to being inadvertently damaged.  In order to minimize the risk of damage, the following guidelines must be followed:

•           Environmental controls should keep the operating environment of company systems within standards specified by the manufacturer.  These standards often involve, but are not limited to, temperature and humidity.

•           Proper grounding procedures must be followed when opening system cases.  This may include use of a grounding wrist strap or other means to ensure that the danger from static electricity is minimized.

•           Strong magnets must not be used in proximity to company systems or media.

•           Except in the case of a fire suppression system, open liquids must not be located above company systems.  Technicians working on or near company systems should never use the systems as tables for beverages.  Beverages must never be placed where they can be spilled onto company systems.

•           Uninterruptible Power Supplies (UPSs) and/or surge-protectors are required for all company systems. These devices must carry a warranty that covers the value of the systems if the systems were to be damaged by a power surge.


4.6 Fire Prevention
It is the company’s policy to provide a safe workplace that minimizes the risk of fire.  In addition to the danger to employees, even a small fire can be catastrophic to computer systems.  Further, due to the electrical components of IT systems, the fire danger in these areas is typically higher than other areas of the company’s office.  The guidelines below are intended to be specific to the company’s information technology assets and should conform to the company’s overall fire safety policy.

•           Fire, smoke alarms, and/or suppression systems must be used, and must conform to local fire codes and applicable ordinances.

•           Electrical outlets must not be overloaded.  Users must not chain multiple power strips, extension cords, or surge protectors together.

•           Extension cords, surge protectors, power strips, and uninterruptible power supplies must be of the three-wire/three-prong variety.

•           Only electrical equipment that has been approved by Underwriters Laboratories and bears the UL seal of approval must be used.

•           Unused electrical equipment should be turned off when not in use for extended periods of time (i.e., during non-business hours) if possible.

•           Periodic inspection of electrical equipment must be performed.  Power cords, cabling, and other electrical devices must be checked for excessive wear or cracks.  If overly-worn equipment is found, the equipment must be replaced or taken out of service immediately depending on the degree of wear.

•           A smoke alarm monitoring service must be used that will alert a designated company employee if an alarm is tripped during non-business hours.


4.7 Entry Security
It is the company’s policy to provide a safe workplace for employees.  Monitoring those who enter and exit the premises is a good security practice in general, but is particularly true for minimizing risk to company systems and data.  The guidelines below are intended to be specific to the company’s information technology assets and should conform to the company’s overall security policy.


4.7.1 Use of Identification Badges
Identification (ID) badges are useful to identify authorized persons on the company premises.  The company has established the following guidelines for the use of ID badges.

•           Employees: Photo ID badges are required and must be displayed at all times while on company premises. Employees must remove their badges from view when out of the office.

•           Non-employees/Visitors: Visitor badges are required.  Specific, non-generic badges must identify visitors by name and the date of the visit.  The company should investigate visitor badges that automatically expire and determine if the use of such technology is feasible for use.

•           Users must a report lost or stolen badge immediately to his or her supervisor.  A temporary badge may be utilized in such cases until the badge can be re-generated.

•           Initial badge generation will be done only at the direction of Human Resources for new hires or users changing jobs.  Users must show photo identification for identity verification.


4.7.2 Sign-in Requirements
The company must maintain a sign-in log (or similar device) in the lobby or entry area and visitors must be required to sign in upon arrival.  At minimum, the register must include the following information: visitor’s name, company name, reason for visit, name of person visiting, sign-in time, and sign-out time.


4.7.3 Visitor Access
Visitors should be given only the level of access to the company premises that is appropriate to the reason for their visit.  After checking in, visitors must be escorted unless they are considered “trusted” by the company.  Examples of a trusted visitor may be the company’s legal counsel, financial advisor, or a courier that frequents the office, and will be decided on a case-by-case basis.


4.8 Applicability of Other Policies
This document is part of the company’s cohesive set of security policies.  Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.


5.0 Enforcement

This policy will be enforced by the IT Manager and/or Executive Team. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property (physical or intellectual) are suspected, the company may report such activities to the applicable authorities.


6.0 Definitions

Biometrics  The process of using a person’s unique physical characteristics to prove that person’s identity.  Commonly used are fingerprints, retinal patterns, and hand geometry.

Datacenter  A location used to house a company’s servers or other information technology assets.  Typically offers enhanced security, redundancy, and environmental controls.

Keycard  A plastic card that is swiped, or that contains a proximity device, that is used for identification purposes.  Often used to grant and/or track physical access.

Keypad  A small keyboard or number entry device that allows a user to input a code for authentication purposes.  Often used to grant and/or track physical access.

Mobile Device  A portable device that can be used for certain applications and data storage.  Examples are PDAs or Smartphones.

PDA  Stands for Personal Digital Assistant.  A portable device that stores and organizes personal information, such as contact information, calendar, and notes.

Smartphone  A mobile telephone that offers additional applications, such as PDA functions and email.

Uninterruptible Power Supplies (UPSs)  A battery system that automatically provides power to electrical devices during a power outage for a certain period of time.  Typically also contains power surge protection.

7.0 Revision History

Revision 2.0, 1/1/2015