PS-01 Physical Security and Environmental Control Requirements
Derive documented physical and environmental security requirements for all premises and data centres from risk assessment and identified protection needs, addressing planning faults, intrusion, surveillance, climate cont
4
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Signed physical and environmental security concept listing the eight hazard classes · Physical access / facilities
governing documentDocuments that govern the control
- Site level protection requirement analysis for each data centre · Policy repository / GRC workspace
- Contractual security requirement annex imposed on third party landlords · Policy repository / GRC workspace
- Record of the technology standards or building codes cited as the design basis · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Concept written once at build time and never revisited after new sites were added
- Third party operated colocation sites left outside the documented requirements
- Hazards such as water ingress and air filtration named with no requirement attached to them
- No traceable link from risk assessment results to the stated building requirements
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet