Куда я попал?
Framework № PCI DSS 4.0 от 01.03.2022
Payment Card Industry Data Security Standard (RU)
Requirement 9.3.1.1
Для проведения оценки соответствия по документу войдите в систему.
Список требований
Похожие требования
ГОСТ Р № 57580.1-2017 от 01.01.2018 "Безопасность финансовых (банковских) операций. Защита информации финансовых организаций. Базовый состав организационных и технических мер. Раздел 7. Требования к системе защиты информации":
ФД.2
ФД.2 Контроль перечня лиц, которым предоставлено право самостоятельного физического доступа в помещения
3-О 2-О 1-Т
3-О 2-О 1-Т
ФД.3
ФД.3 Контроль самостоятельного физического доступа в помещения для лиц, не являющихся работниками финансовой организации
3-Н 2-О 1-Т
3-Н 2-О 1-Т
ФД.9
ФД.9 Оборудование помещений средствами (системами) контроля и управления доступом
3-Н 2-Н 1-Т
3-Н 2-Н 1-Т
Framework № PCI DSS 4.0 от 01.03.2022 "Payment Card Industry Data Security Standard":
Requirement 9.3.1.1
9.3.1.1
Defined Approach Requirements:
Physical access to sensitive areas within the CDE for personnel is controlled as follows:
Defined Approach Requirements:
Physical access to sensitive areas within the CDE for personnel is controlled as follows:
- Access is authorized and based on individual job function.
- Access is revoked immediately upon termination.
- All physical access mechanisms, such as keys, access cards, etc., are returned or disabled upon termination.
Customized Approach Objective:
Sensitive areas cannot be accessed by unauthorized personnel.
Defined Approach Testing Procedures:
Sensitive areas cannot be accessed by unauthorized personnel.
Defined Approach Testing Procedures:
- 9.3.1.1.a Observe personnel in sensitive areas within the CDE, interview responsible personnel, and examine physical access control lists to verify that:
- Access to the sensitive area is authorized.
- Access is required for the individual’s job function.
- 9.3.1.1.b Observe processes and interview personnel to verify that access of all personnel is revoked immediately upon termination.
- 9.3.1.1.c For terminated personnel, examine physical access controls lists and interview responsible personnel to verify that all physical access mechanisms (such as keys, access cards, etc.) were returned or disabled.
Purpose:
Controlling physical access to sensitive areas helps ensure that only authorized personnel with a legitimate business need are granted access.
Good Practice:
Where possible, organizations should have policies and procedures to ensure that before personnel leaving the organization, all physical access mechanisms are returned, or disabled as soon as possible upon their departure. This will ensure personnel cannot gain physical access to sensitive areas once their employment has ended.
Controlling physical access to sensitive areas helps ensure that only authorized personnel with a legitimate business need are granted access.
Good Practice:
Where possible, organizations should have policies and procedures to ensure that before personnel leaving the organization, all physical access mechanisms are returned, or disabled as soon as possible upon their departure. This will ensure personnel cannot gain physical access to sensitive areas once their employment has ended.
Guideline for a healthy information system v.2.0 (EN):
26 STANDARD
/STANDARD
Physical security mechanisms must be a key part of information systems security and be up to date to ensure that they cannot be bypassed easily by a hacker. It is, therefore, advisable to identify the suitable physical security measures and to raise users’ awareness continuously of the risks caused by bypassing these rules.
Access to server rooms and technical areas must be controlled with the assistance of locks or access control mechanisms such as badges. The unaccompanied access of external service providers to sever rooms and technical areas must be prohibited, except if it is possible to strictly monitor the access and limit it to given time intervals. A regular review of the access rights must be carried out, in order to identify any unauthorised access.
When an employee leaves or there is a change of service provider, the access rights must be withdrawn or the access codes changed.
Finally, the network sockets in areas open to the public (meeting room, reception hall, corridors, etc.) must be restricted or deactivated in order to stop a hacker easily gaining access to the company’s network.
Physical security mechanisms must be a key part of information systems security and be up to date to ensure that they cannot be bypassed easily by a hacker. It is, therefore, advisable to identify the suitable physical security measures and to raise users’ awareness continuously of the risks caused by bypassing these rules.
Access to server rooms and technical areas must be controlled with the assistance of locks or access control mechanisms such as badges. The unaccompanied access of external service providers to sever rooms and technical areas must be prohibited, except if it is possible to strictly monitor the access and limit it to given time intervals. A regular review of the access rights must be carried out, in order to identify any unauthorised access.
When an employee leaves or there is a change of service provider, the access rights must be withdrawn or the access codes changed.
Finally, the network sockets in areas open to the public (meeting room, reception hall, corridors, etc.) must be restricted or deactivated in order to stop a hacker easily gaining access to the company’s network.
ГОСТ Р № ИСО/МЭК 27001-2021 от 01.01.2022 "Информационная технология. Методы и средства обеспечения безопасности. Системы менеджмента информационной безопасности. Требования - Приложение А":
A.11.1.3
A.11.1.3 Безопасность зданий, помещений и оборудования
Мера обеспечения информационной безопасности: Должна быть разработана и реализована физическая защита зданий, помещений и оборудования
Мера обеспечения информационной безопасности: Должна быть разработана и реализована физическая защита зданий, помещений и оборудования
Стандарт № ИСО/МЭК 27001:2022(E) от 25.10.2022 "Информационная безопасность, кибербезопасность и защита частной жизни — Системы управления информационной безопасностью — Требования. Приложение А":
А.7.2
А.7.2 Защита физического входа
Зоны физической безопасности должны быть защищены соответствующими средствами контроля и управления доступом.
Зоны физической безопасности должны быть защищены соответствующими средствами контроля и управления доступом.
SWIFT Customer Security Controls Framework v2022:
3 - 3.1 Physical Security
3.1 Physical Security
Стандарт № ISO/IEC 27001:2022(E) от 25.10.2022 "Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Annex A":
А.7.2
А.7.2 Physical entry
Secure areas shall be protected by appropriate entry controls and access points.
Secure areas shall be protected by appropriate entry controls and access points.
Связанные защитные меры
Ничего не найдено
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.