Physical Protection of Unclassified Key System Devices/Computer Rooms in Large Processing Facilities

From Traditional Security

Part of Physical Protection of Unclassified Key System Devices

Associated with IA controls: PECF-1, PECF-2

SV-42917r2_rule Physical Protection of Unclassified Key System Devices/Computer Rooms in Large Processing Facilities

Vulnerability discussion

Allowing access to systems processing sensitive information by personnel without the need-to-knowcould permit loss, destruction of data or equipment or a denial of service. Loss could be accidentaldamage or intentional theft or sabotage.

Check content

Checks: 1. Check to ensure that Unclassified system assests (servers, DASD, tape drives, hubs, etc.) are protected in separate locked/access controlled rooms or closets. NOTE 1: This potential VUL concerns protection of "ONLY UNCLASSIFIED" System and Network Devices. NOTE 2: While not required; the ideal situation with larger computer systems is to locate all major system components within "raised floor" computer rooms. Regardless of the location the key factor in determining acceptable compliance is if the equipment is accessible only to properly vetted persons who require unescorted access to the equipment for performance of duties. NOTE 3: While not preferred, if space and/or size of the Information Systems (IS) assets do not allow for being housed in a separate room or closet they may be maintained in locked Information System (IS) cabinets that preclude ease of access by unauthorized individuals. 2. Check to ensure that properly managed access control systems, mechanical access devices, or keyed locks are being used to control access to these rooms, closets or cabinets. NOTE 4: If keyed locks are used check to ensure that proper key control procedures are in place. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

Fix text

Fixes: 1. Ensure that Unclassified system assests (servers, DASD, tape drives, hubs, etc.) are protected in separate locked/access controlled rooms or closets. NOTE 1: This potential VUL concerns protection of "ONLY UNCLASSIFIED" System and Network Devices. NOTE 2: While not required; the ideal situation with larger computer systems is to locate all major system components within "raised floor" computer rooms. Regardless of the location the key factor in determining acceptable compliance is if the equipment is accessible only to properly vetted persons who require unescorted access to the equipment for performance of duties. NOTE 3: While not preferred, if space and/or size of the Information Systems (IS) assets do not allow for being housed in a separate room or closet they may be maintained in locked Information System (IS) cabinets that preclude ease of access by unauthorized individuals. 2. Ensure that properly managed access control systems, mechanical access devices, or keyed locks are being used to control access to these rooms, closets or cabinets. NOTE 4: If keyed locks are used, ensure that proper key control procedures are in place.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer