Physical and Environmental Security Policy

Purpose

This Policy protects the buildings, rooms, and equipment where Tidewell IT handles information against unauthorised entry, damage, theft, and environmental harm.

Scope

This Policy covers the Utrecht office, the two data centre suites that colocation providers operate for us, and the equipment, visitors, and staff in them.

Policy statements

Security zones

1. Premises are divided into three zones: Public, Office, and Restricted. Each zone has its own access rules.
2. The Restricted zone holds the server rooms, network equipment, and stored backup media. Only named people have access to it.

Office access

1. Access to the Office zone and the Restricted zone needs a personal badge, and badge access is logged.
2. Visitors are signed in at reception, wear a visitor badge, and are escorted at all times.
3. Badges are personal and are never lent to others. A badge is withdrawn on the day its holder leaves.

Data centres

1. The colocation providers control access to the data centre buildings. Tidewell IT staff enter only after the visit has been requested through the provider and approved.
2. Our racks stay locked, and every visit is logged.
3. Equipment of different customers is kept apart, and staff touch only the equipment that the visit concerns.

Securing offices and rooms

1. Doors are closed and locked outside office hours. Windows on the ground floor stay shut and secured.
2. Rooms that hold sensitive equipment carry no sign that shows what is inside.
3. Printers are placed in the Office zone, and printed documents are collected at once.

Monitoring

1. Entrances are covered by cameras, and the footage is kept for 30 days.
2. Badge logs and alarm events are reviewed every quarter, and anything unusual is reported to the ISMS Manager.
3. The alarm system is tested every year, and the result is recorded.

Environmental threats

1. Server rooms have fire detection and suppression, temperature and water sensors, and protected power supplies.
2. The providers test power and cooling regularly, and Tidewell IT asks for the results.
3. Fire extinguishers in the office are inspected every year, and staff know the evacuation routes.

Equipment siting

1. Equipment is placed away from public view and from environmental hazards. Screens that show sensitive information face away from windows and walkways.
2. Equipment maintenance is carried out by authorised people only and is recorded.

Working in secure areas

1. In the Restricted zone staff work only on approved tasks. Photography and unapproved recording are not allowed.
2. Unoccupied secure areas are locked and inspected at regular times.

Roles and responsibilities

The ISMS Manager owns this Policy. The Facilities Lead issues and withdraws badges, keeps the access lists for the Office and Restricted zones, looks after cameras and alarms, and coordinates with the landlord and the providers. The Service Desk Lead approves data centre visits. The Management Board provides the resources.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. No exception allows a visitor to be unescorted in a Restricted zone.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. A lost badge or an unescorted visitor is reported to the Service Desk at once.

Related documents

• Physical Access and Visitor Management Procedure
• Information Security Policy
• Business Continuity and Disaster Recovery Policy
• Access Control Policy
• Incident Response Policy

Review

The ISMS Manager reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.