IT Security Standard: Computing Devices - Physical Placement

Required

All Devices

• All computing devices and storage media must be located in a space such that when unattended, one of the following controls are in place
  • the device and/or media is protected by entry controls to ensure that only authorized personnel are allowed access to the space containing the device and/or media,
  • the device and/or media is secured in a controlled container,
  • the device and/or media is physically secured to permanent furniture or structures within the space.

Single-user Devices Storing Level 1 Data

• Single-user devices storing Level 1 data must be attended or secured with controls to ensure that only authorized personnel are allowed access to the device. 
• Single-user devices storing Level 1 data located outside of spaces restricted to authorized personnel (e.g. traveling with a laptop) must encrypt the data following the encryption device requirements of this standard.

High Risk Enterprise Computing Devices

• High Risk enterprise computing devices must be housed in a space with following characteristics:
  • Protected by entry controls to ensure that only authorized personnel are allowed access
  • Access to the space is logged independently from the person accessing the facility (e.g. automated logging technology, receptionist, etc.) and access logs are retained for six months.
  • Protected with an appropriate fire notification system and firefighting equipment
  • Cooling that ensures temperatures remain within equipment specifications
  • Uninterruptible power to ensure availability expectations for the device.
  • Communications cabling meets CSU TIP and ITRP Standards

Recommended

All Devices

• Only store Level 1 data on High Risk Enterprise Computing Devices.  The potential for Level 1 data to be compromised can be substantially reduced by only storing Level 1 data on High Risk Enterprise Computing Devices.

Enterprise Computing Devices

• Protected by entry controls to ensure that only authorized personnel are allowed access
• Protected with appropriate fire fighting equipment (e.g. fire extinguisher)
• Cooling that ensures temperatures remain within equipment specifications
• Uninterruptible power sufficient to allow operation in the event of a small power outage to prevent hardware damage or data corruption

 

---

Continue to System Configuration and Maintenance | Return to Table of Contents