Physical and Personnel Security

Access controls, identification security, hiring practices,
incident reporting, integrity management and more

Focus will be placed on examining key access controls, identification security, internal controls, hiring & background screening, incident reporting, integrity management, and other physical and personnel security linkages that directly relate to IS vulnerabilities.

The assessment of the physical and personnel Security capacity for the client is not intended to be an "all-encompassing" analysis of every detailed aspect of physical and personnel security. That level of analysis would be another exercise onto itself and may take away from the objective to focus on Information Security. This assessment will focus on those components of physical and personnel security that impact the Integrated Information security position of the client.

The environmental scan for the physical and personnel security section will provide a short and high level overview of key considerations and drivers affecting the current situation for the client. This will also include a general description of the building and the surrounding areas, as well as environmental factors possible impacting physical security management. In addition, this section will outline high-level threats (internal and external) to the organization's physical and personnel security identified through the interviews and other information gathering.

Some key objectives include:

Primary

Identify internal physical security controls that play a major role in protecting IS for the client and collect information that will support the identification of vulnerabilities.
Identify corporate hiring and personnel management measures that are used to protect the client from risks that may impact IS.

Secondary

What measures are in place to manage identification and access control?
How are physical spaces such as offices, desks and storage areas managed to secure information?
Does the client have the proper equipment to secure high value physical assets and information?
Does the building present any fundamental vulnerabilities impacting IS?
How does the client use CCTV technology?
Is there a solid approach to managing keys, locks and security logs?
How do previous security incidences relating to IS impact planning?
What is the approach to after-hours monitoring, response and notification?
Do the necessary policies and procedures relating to physical security exist?
What is the client's approach to securing Intellectual Property (IP)?
What is the process and approach to vetting / background checks before hiring or promotions?
Does the client effectively use HR tools such as a code of conduct, conflict of interest policies, values and ethics, and professional integrity standards to help reduce risk and secure information?
Are non disclosure agreements and procedures for termination in place to support IS?

Stakeholders we work with from your organization:

It is important to the data gathering process that the appropriate managers and other accountable representatives attend the data gathering meetings to ensure the required information to support an effective analysis is obtained. It is recognized that certain client representatives may have multiple responsibilities and terminology may vary, therefore, it is critical to make prior preparations with the Project Lead during the Introduction meeting to ensure representative with the following accountably attend this meeting:

Project Lead
Executive Responsible for Information and/or Corporate Security
Chief Security Officer or Manager
Executive Responsible for Human Resources
HR representatives responsible for staffing and ethics
Physical Security Officers
Representative responsible for their Privacy Protection Program
Executive Responsible for Corporate Services
Representatives from Facilities Management
Representative responsible for Network, Electronic Information and Cyber Security
Policy Development
Managers responsible for hiring

Physical and Personnel Security

Access controls, identification security, hiring practices,
incident reporting, integrity management and more

Some key objectives include:

Primary

Secondary

Stakeholders we work with from your organization:

Contact Us

Quick Links

Physical and Personnel Security

Access controls, identification security, hiring practices,incident reporting, integrity management and more

Some key objectives include:

Primary

Secondary

Stakeholders we work with from your organization:

Contact Us

Quick Links

Access controls, identification security, hiring practices,
incident reporting, integrity management and more