ISO 27001 Annex : A.11.2 Equipment

ISO 27001 Annex : A.11.2 Equipment Its objective is to avoid loss, damage, theft, or compromise of assets and disrupt the operations of the organization.

A.11.2.1  Equipment Siting and Protection

Control- To mitigate the risk of environmental hazards, risks, and unauthorized access, the equipment should be sited and secured.

Implementation Guidance- To protect equipment, the following directives should be considered:

1. In order to minimize unnecessary access in work areas, equipment should be sited;
2. Information processing facilities that handle sensitive information should be carefully positioned to reduce the risk of unauthorized persons viewing information during their use;
3. In order to avoid unauthorized access, storage facilities should be secured;
4. Objects requiring special protection should be protected to reduce the required level of overall protection;
5. The risk of potential threats to the environment and physicality such as theft, fire, explosives, smoke, and water, dust, vibrations, chemical effects, interference with electrical supplies, interference with communications, electric radiation and vandalism should be minimized;
6. Guidelines should be defined for eating, drinking and smoking close to information processing facilities;
7. Environmental factors such as temperature and humidity for factors which may have a negative effect on the operation of information processing facilities should be monitored;
8. Lightening protection for all buildings, and lightning protection filters for all incoming power and communications lines should be implemented;
9. In order to reduce the risk of information leakage due to electromagnetic emanation, sensitive information treatment equipment should be secured.
10. Special protection methods such as keyboard membranes for equipment in industrial environments should be considered;

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

The Organization wishes that its information to remain within the CIA triads. They also ensure that the physical security controls are properly and efficiently implemented to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities. The physical and environmental protection of the company is covered in Annex 11 of ISO 27001. This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization. Infosavvy, a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the physical and environmental security of your organization that is necessary to protect the operations of your organization from attacks. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques

A.11.2.2  Supporting Utilities

Control- Equipment should be secured against power failures and other disruptions caused by the supporting infrastructure failures.

Implementation Guidance- The support facilities (e.g. power, telecommunications, water, gas, sanitation, air conditioning, and ventilation) should consider the following points:

1. conform to specifications and local legal requirements of the equipment manufacturer;
2. be periodically assessed for its ability to fulfill corporate growth and relations with other supporting utilities;
3. to be regularly inspected and tested for effective functioning;
4. keep Alarm for detecting malfunctions if necessary;
5. Have multiple physical routing feeds, if necessary.

It should be provided with emergency lighting and communication. Emergency switches and valves should be located close to emergency exits or equipment rooms for power, water, gas or other utilities.

Other Information- Additional redundancy can be achieved through several routes from more than a single utility provider for network connectivity.

Also Read : ISO 27001 Annex : A.11 Physical and Environmental Security

A.11.2.3  Cabling Security

Control- Cable for power and telecommunications that carry data or support services should be safeguarded from interception, interference, or damage.

Implementation Guidance- The following cable safety guidelines should be taken into account:

1. power and telecommunications lines should be underground or subject to appropriate, alternative, security into information processing facilities where possible;
2. Power cables should be isolated in order to avoid interference from communication cables;
3. Additional controls to reflect on sensitive or critical systems include:

• Installation of reinforced ducts and locked rooms or boxes at inspection and termination points;
• Electromagnetic shielding for cable protection;
• Initiation of technical sweeps and physical inspections of unauthorized cable devices;
• Access controlled to cable rooms and patch panels.

Questions related to this topic

1. What is the difference between requirements and controls in the security process?
2. What are the three routes possible for data interception According to NIST?
3. What does a security plan include?
4. How many controls are there in ISO 27001 Annex : A.11.2 Equipment?
5. Explain ISO 27001 Annex : A.11.2 Equipment?

---

This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ