Physical and environmental security Control Assessment Guidance Security perimeters are used Confirm the Information Security Documentation contains a Physical & Environmental Security Plan. to protect areas that contain Review the Information Security Documentation to verify that each physical and environmental security control detailed in either sensitive or critical the document is still in place and operating as intended. information or information processing facilities. Verify that any instances of compromise or suspected compromise have been managed in accordance with the Information Security Documentation Secure areas are protected by appropriate entry controls to Obtain evidence that a review of physical and environmental security arrangements has been conducted in the period ensure that only authorised since the last Gatekeeper compliance audit (or since accreditation if undertaking the first Gatekeeper compliance audit)? personnel are allowed access. Examine the results of the last security review Physical protection against Were there any adverse findings? natural disasters, malicious attacks or accidents are Have all remediation actions been authorised and implemented? designed and applied. Verify that all physical control tests and maintenance checks were conducted in the period since the last Gatekeeper PKI services are not directly compliance audit (or since accreditation if undertaking the first Gatekeeper compliance audit). Consider: accessible from the Internet. Alarm and physical security control systems. Networks are managed and Emergency response processes. controlled to protect information processing Intrusion detection and prevention systems. facilities and information in Firewall rules. systems and applications. Environmental and fire control systems. UPS and power generators. The number of telecommunication service providers used. Examine the results of these tests and checks. Were there any adverse findings? Have all remediation actions been authorised and implemented?
Physical and environmental security Control Assessment Guidance Security perimeters are used to protect areas that contain either sensitive or critical information or information processing facilities. Secure areas are protected by appropriate entry controls to ensure that only authorised personnel are allowed access. Physical protection against natural disasters, malicious attacks or accidents are designed and applied. PKI services are not directly accessible from the Internet. Networks are managed and controlled to protect information processing facilities and information in systems and applications. Confirm the Information Security Documentation contains a Physical & Environmental Security Plan. Review the Information Security Documentation to verify that each physical and environmental security control detailed in the document is still in place and operating as intended. Verify that any instances of compromise or suspected compromise have been managed in accordance with the Information Security Documentation Obtain evidence that a review of physical and environmental security arrangements has been conducted in the period since the last Gatekeeper compliance audit (or since accreditation if undertaking the first Gatekeeper compliance audit)? Examine the results of the last security review Were there any adverse findings? Have all remediation actions been authorised and implemented? Verify that all physical control tests and maintenance checks were conducted in the period since the last Gatekeeper compliance audit (or since accreditation if undertaking the first Gatekeeper compliance audit). Consider: Alarm and physical security control systems. Emergency response processes. Intrusion detection and prevention systems. Firewall rules. Environmental and fire control systems. UPS and power generators. The number of telecommunication service providers used. Examine the results of these tests and checks. Were there any adverse findings? Have all remediation actions been authorised and implemented?
Gatekeeper-PKI-Framework-Compliance-Audit-Program-v2_1.docx