IT PHYSICAL SECURITY POLICY

Date Amended: Status: Active/Archived Date Added: 09/05/2024

IT Physical Security Policy
This Policy provides governance to safeguard physical IT infrastructure, data, and related resources from unauthorized access, damage, or theft.	Author
Policy #
Effective Date

TEMPLATE INSTRUCTIONS AND NOTE (DELETE BEFORE PUBLISHING) Text in red is highlighted for Organization-specific updates

Purpose

The purpose of this Policy is to establish <Organization’s> expectations for safeguarding physical IT infrastructure, data, and related resources from unauthorized access, damage, theft, or environmental hazards.

Scope

This Policy applies to:

All Workforce Members, including but not limited to employees, contractors, consultants, officers, board members, and temporary personnel.

All IT assets and physical facilities housing IT systems, including data centers, server rooms, workstations, network equipment, mobile devices, and storage media.

Third-party vendors and contractors with physical access to IT infrastructure.

<Organization> may create location– or business unit–specific policies, procedures, standards, and processes to address physical security concerns. These additional guidelines are extensions to this Policy and require compliance from all applicable Workforce Members.

IT Physical Security Policy

Access Controls

Physical access to IT infrastructure, including server rooms, data centers, and networking closets, shall be restricted to authorized personnel only.

Multi-factor authentication (e.g., key cards and PINs) must be required for entry into sensitive IT areas.

All access attempts must be logged and monitored for auditing purposes.

Visitors must be escorted by authorized personnel and logged in an access register.

Access permissions must be reviewed and updated regularly to ensure they align with job responsibilities.

Facility Security

Critical IT infrastructure must be housed in secure, locked rooms with restricted access.

Surveillance systems (e.g., CCTV cameras) must monitor entry points and key physical infrastructure areas.

Environmental controls (e.g., HVAC systems, smoke detectors, fire suppression systems) must be implemented to prevent environmental hazards.

Backup power supplies (e.g., UPS systems) must be in place to ensure continuous operation of critical systems.

Equipment Security

IT equipment must be physically secured to prevent theft, tampering, or damage.

Portable devices (e.g., laptops, tablets, USB drives) must be secured when unattended.

Devices containing ePHI (electronic Protected Health Information) must be encrypted and securely stored when not in use.

Decommissioned IT equipment must undergo secure data wiping or destruction following NIST standards.

Workstation Security

Workstations must be locked or logged off when unattended.

Users must not leave sensitive information visible on screens or printed materials.

Public or shared workstations must be configured to prevent unauthorized data access.

Physical workstation layouts must minimize unauthorized shoulder-surfing risks.

Incident Response for Physical Security Breaches

Incident Response for Physical Security Breaches

All physical security breaches or suspicious activities must be immediately reported to the IT Security Team.

An incident report must be created and documented for each security event.

Physical security incidents must follow the procedures outlined in the Security Incident Response Policy.

Responsible Parties

<Director of Information Services>: Responsible for overseeing the implementation and enforcement of this policy.

<IT/Security Team>: Responsible for monitoring physical security controls and addressing incidents.

<Facilities Management Team>: Responsible for maintaining physical infrastructure security and environmental controls.

Policy Exceptions

Exceptions to information security policies may be granted in unusual and unique circumstances when it is not possible to comply with a specific policy. Exception requests must be made by submitting a written request to the <Director of Information Services or Responsible Individual>.

The <Director of Information Services or Responsible Individual> must document within the written approval the mitigating controls that must be followed for the exception, along with the reasonable time period for which the exception is granted.

In case of uncertainty as to the ability to approve an exception because of mandatory legal or regulatory requirements, the Exception requests must be made by submitting a written request to the <Director of Information Services or Responsible Individual> must consult with Legal.

Compliance

The <Director of Information Services or Responsible Individual> will employ multiple methods, tools, and audit processes to monitor and assess whether security controls and measures have been implemented and are being followed.

Non-compliance with this policy will result in notifications to the employee and management. Further consequences may include disciplinary action up to and including termination of employment (with cause) and/or legal proceedings to recover any loss or damage to <Organization> and possibly third parties affected.

Applicable Laws/Regulations/Legal Requirements

Supports the following regulations and standards:

HIPAA §164.310(a)(1): Facility Access Controls

HIPAA §164.310(b): Workstation Use

HIPAA §164.310(c): Workstation Security

HIPAA §164.310(d): Device and Media Controls

Referenced Documents

Document	Description	Links
Network Security Policy	Defines secure management of network infrastructure.	<insert link>
Acceptable Use Policy	Outlines the acceptable use of information resources, including workstations, information systems, applications, equipment, or other resources that may store confidential information.	<insert link>
Security Incident Response Policy	Outlines the scope, responsibilities, and guidelines for responding to security incidents within the organization.	<insert link>

Revision History

Version	Date	Author	Description of Change
0.01	Initial draft