9.2.3 Physical access to networking and telecommunications hardware restricted
Physical access within the facility to wireless access points, gateways, networking and communications hardware, and telecommunication lines is restricted, so that networking equipment cannot be reached by unauthorized p
5
artefacts
1
held by a system
2
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Badge system access list for comms rooms and wiring closets, with authorization approvals · Physical access / facilities
periodic reviewEvidence produced at each review
- Evidence that wiring closets, comms rooms and network cabinets are locked (photos, lock or badge reader records) · Physical access / facilities
- Walkthrough or inspection records confirming exposed network hardware is secured · Physical access / facilities
governing documentDocuments that govern the control
- Floor plan or inventory locating wireless access points, gateways, switches, patch panels and telecom lines · Policy repository / GRC workspace
- Procedure covering physical protection of wireless access points in public or visitor areas · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Wireless access points mounted in open ceilings or public areas with no tamper protection
- Wiring closets unlocked or propped open
- Comms room badge list never reviewed and full of leavers
- Network hardware inventory does not record physical location, so nothing can be verified
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.2.2 Physical and/or logical controls are implemented to restrict use of publicly accessible network jacks within the facility · 9.2.4 Consoles in sensitive areas locked when not in use