Find Resources & Connect with members on topics that interest you.

Applications

Audit

Business Processes

Career Management

Cloud Computing/Virtualization

COBIT

Controls and Monitoring

Databases

Fraud and Computer Crime

Governance and Management

Industry

Information Security

IT Service Management

Mobile/Wireless

Operating Systems

Privacy/Data Protection

Regulations

Risk

Standards

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

ME - Monitor and Evaluate

Application Controls

Process Controls

Please sign in to see your topics.

You must be logged in to join this group.

DS12.2 - Physical Security Measures

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective DS12.2 - Physical Security Measures is contained within Process Popup Manage the Physical Environment.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
2 Members
0 Online
758 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Points: 3

Physical Security Measures

Define and implement physical security measures in line with business requirements to secure the location and the physical assets. Physical security measures must be capable of effectively preventing, detecting and mitigating risks relating to theft, temperature, fire, smoke, water, vibration, terror, vandalism, power outages, chemicals or explosives.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Protection of critical IT systems from physical threats
  • Effective deployment of physical security measures
  • Promotion of awareness amongst staff and management of the organisation’s requirements for physical security
   Risk Drivers
  • Threats to physical security not identified
  • Hardware stolen by unauthorised people
  • Physical attack on the IT site
  • Devices reconfigured without authorisation
  • Confidential information being accessed by devices configured to read the radiation emitted by the computers

View Control Practices  help

Hide Control Practices  help

  1. Define and implement a policy for the physical security and access control measures to be followed for IT sites. Regularly review the policy to ensure that it remains relevant and up to date.
  2. Limit the access to information about sensitive IT sites and the design plans. Ensure that external signs and other identification of sensitive IT sites are discreet and do not obviously identify the site from outside. Confirm that organisational directories/site maps do not identify the location of the IT site.
  3. Design physical security measures to take into account the risk associated with the business and operation. Physical security measures include alarm systems, building hardening, armoured cabling protection and secure partitioning.
  4. Periodically test and document the preventive, detective and corrective physical security measures to verify design, implementation and effectiveness.
  5. Ensure that the site design takes into account the physical cabling of telecommunication and the piping of water, power and sewer. The installation must be concealed, so it is not directly visible. The piping of water and sewer must also be redirected away from the server rooms.
  6. Define a process for the secure removal of IT equipment, supported by the appropriate authorisation.
  7. Safeguard receiving and shipping areas of IT equipment in the same manner and scope as normal IT sites and IT operations.
  8. Define and implement a policy and process to transport and store equipment securely.
  9. Define a process to ensure that storage devices containing sensitive information are physically destroyed or sanitised.
  10. Define a process for recording, monitoring, managing, reporting and resolving physical security incidents, in line with the overall IT incident management process.
  11. Ensure that particularly sensitive sites are checked frequently (including weekends and holidays).

 

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 84 total

Must be a Topic member to contribute
View All »
Books
Information Security Policies Made Easy, Version 12
Posted by ISACA 11 days ago
ICQs and Audit Programs
Windows Active Directory Audit/Assurance Program (Aug 2010)
Posted by ISACA 26 days ago
ICQs and Audit Programs
IT Strategic Management Audit/Assurance Program (Dec 2011)
Posted by ISACA 26 days ago
Books
Securing Clicks: Network Security in the Age of Social Media
Posted by ISACA 34 days ago
Books
Information Security Roles & Responsibilities Made Easy, Version 3.0
Posted by ISACA 34 days ago
Books
Protecting Industrial Control Systems from Electronic Threats
Aimed at both the novice and expert in IT security and industrial control systems (ICS), this book will help readers gain a better understanding of protecting ICSs from electronic threats.
Posted by ISACA 57 days ago
View All »

Events & Online Learning: 7 total

View All »
7 May 2012
ISACA International Event
North America CACS 2012
Orlando, Florida, USA
Get the knowledge you need to stay one step ahead of the competition and keep up with changing professional trends at ISACA’s North America CACS Conference.
More »
Add to my Outlook
12 Jun 2012
ISACA International Event
Training Dallas Texas USA
Dallas, Texas, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
7 Aug 2012
ISACA International Event
Training Chicago Illinois USA 2012
Chicago, Illinois, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
11 Sep 2012
ISACA International Event
Training San Francisco California USA
San Francisco, California, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
2 Oct 2012
ISACA International Event
Training Orlando Florida USA
Orlando, Florida, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
6 Nov 2012
ISACA International Event
Training New York NY USA
New York, New York, USA
ISACA Training is a unique educational event designed to provide the tools you need to maintain, update and upgrade your skills, and to continue your professional development.
More »
Add to my Outlook
Register Now
View All »

Journal Articles: 252 total

View All »
Volume 2, 2019
Standards, Guidelines, Tools and Techniques
by ISACA Member and Certification Holder Compliance
Volume 3, 2012
Audit Evidence Refresher
by Ookeditse Kamau, CISA, CIA
Quality evidence collected during the audit process enhances the overall quality of the work performed and significantly reduces audit risk.
Volume 3, 2012
Auditing Applications, Part 1
by Tommie W. Singleton, Ph.D., CISA, CGEIT, CITP, CPA
This two-part article describes one framework for performing effective audits of applications.
Volume 3, 2012
SOC Progress Report
by Brian Vazzana, CISA, CITP, CPA
SOC reports examine the controls present at the service organizations and consider how those controls are designed and operate.
Volume 3, 2012
Standards, Guidelines, Tools and Techniques
by ISACA Member and Certification Holder Compliance
An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques
Volume 1, 2012
A Room With Machines
by Steven J. Ross, CISA, CISSP, MBCP
If there is to be any advanced technology, the data center and the machines in it need to be operated and maintained in a manner consistent with prudent business practices.
View All »

User Contributed External Links: 0 total

Wikis: 2 total

Blog Posts: 7 total

View All »
7 Mar 2012
Cloud Computing
To share various espects in cloud computing viz; history, availability, deployment, integrity, availability, confidentiality, security, cloud sharing etc.
Posted By : MoizB583519 | 2 comments
6 Mar 2012
SQL Injection story is 14 year old and still the monster is far from being tamed
On March 1st,  I was invited to speak at the CampIT conference on Enterprise Risk/Security Management at Rosemont Convention Center. Before me there were two speakers. The first presenter spent an hour presenting the story from the trenches of technolog...
Posted By : Umesh391 | 0 comments
25 Aug 2011
VENEZUELA, CURSOS PARA CANDIDATOS A CISA 2011
Hola, se les informa a todos los que llamaron y se registraron para los cursos de CISA 2.011, que los mismos comenzarán los siguientes días: 12SEP - 40 Hrs Grupo A  19SEP - 40 Hrs Grupo B 26Sep - 40 Hrs Grupo C Modalidad 16 Hrs intensivas y Presenciale...
Posted By : Alexander Osorio | 0 comments
17 Aug 2011
IT Security
Posted By : masarker | 0 comments
5 Jul 2011
APT Defense Strategy
APT Defense Strategy   By Kevin J. Murphy, CISSP, CISM, CGEIT September 30, 2010 WHAT IS APT? APT is an acronym for Advance Persistent Threat.  Isn’t that descriptive?  In reality there is a lot behind the APT which might not be that obvious from underst...
Posted By : Kevin J. Murphy | 1 comments
19 Oct 2010
cisa exam technique
Hi, Having tried cisa exam twice without success, i think there is more to just reading the manual and scoring 100% on the cisa practice test. Its high time the association let us in on the approach to answering their questions not just feeding us with co...
Posted By : Chinedu276 | 13 comments
View All »
Report An Issue