Office Physical Security
Perimeter & Access
Building access controlled (key cards, biometrics, or managed keys)
Visitor sign-in/sign-out process in place
Visitors escorted in secure areas
Access logs maintained and reviewed
After-hours access restricted and monitored
Delivery areas controlled separately from work areas
Server Room / IT Infrastructure
Dedicated locked room for servers and network equipment
Access restricted to authorised personnel only
Environmental controls (cooling, fire suppression)
UPS / backup power for critical equipment
No food, drink, or storage of flammable materials
CCTV covering entry points (if applicable)
Workspace
Clean desk policy defined and communicated
Screen lock after inactivity (max 5 minutes)
Confidential waste bins or shredders available
Printers in secure locations (pull-printing if possible)
Whiteboards cleared after sensitive discussions
Equipment
Asset labels on company equipment
Secure storage for equipment overnight
Process for reporting lost or stolen equipment
Disposal procedure for old equipment (data wiping)
Remote Worker Security
Home Office
Dedicated workspace recommended (not public areas)
Company laptop used for work (not personal devices, where policy requires)
Screen privacy maintained during video calls
Home Wi-Fi secured with WPA3/WPA2 and strong password
Router firmware kept updated
Mobile Working
Laptop privacy screen for public spaces
No sensitive discussions in public areas
VPN required for accessing company resources
Device encryption enabled
Remote wipe capability for lost/stolen devices
Documentation
Remote working policy signed by all remote workers
Security awareness training covers remote risks
Process for returning equipment on termination
Periodic self-assessment by remote workers
What Auditors Check
For offices:
•Walk-through of physical security controls
•Sample visitor logs
•Server room access records
•Evidence of clean desk checks
For remote workers:
•Policy documentation
•Evidence of communication and training
•Technical controls (encryption, VPN, remote wipe)
•How you verify compliance