NIST Guidance

NIST 800-14 requires that all portable systems should be secured when not in use and the information stored on them, when cost-effective, should be encrypted.

NIST 800-41 § 4.6 describes the physical security of a firewall. If they can be easily accessed by intruders or accidentally damaged, no matter what kind of defense they might provide, they’re highly vulnerable. It is recommended that they be stored behind locked doors, or kept with guards and physical security alarms.

NIST 800-53 calls for agencies to implement physical access controls over systems and devices that allow for the display or transmission of unencrypted information. The standard also calls for agencies to limit access to laptop computers or other portable information systems to authorized individuals. Additionally, the standard requires that agencies control the delivery and removal of information systems and generate records of such activity.

PE-6 states that the organization should review physical access logs periodically, investigates apparent security violations or suspicious physical access activities, and takes remedial actions.

For moderate and high risk systems, PE-6(1) suggests the organization monitor real-time intrusion alarms and surveillance equipment.

For high risk systems, PE-6(2) suggests the organization employ automated mechanisms to ensure potential intrusions are recognized and appropriate response actions initiated.

NIST 800-66 § 4.11-4.12 address § 164.310(b) and § 164.310(c) of the HIPAA Standard. Both sections cover workstations and how to implement policies and procedures for proper use and security of each employee workstation. Detailed lists of tasks to carry out in order to achieve proper use and security are provided. These lists contain so much information that it is best to read from the document directly.

4.13 matches up with § 164.310(d)(1) of the HIPAA Standard. The goal of this section is to provide detailed steps for implementing policies and procedures for the safe receipt and removal of hardware and electronic media containing electronic protected health information into and out of a facility. This goal is accomplished through the use of an elaborate activities chart describing the process by which an organization may implement appropriate policies and procedures. Due to the high volume of information, it is best to read this section directly.

§ 9.1.3 of Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers Version 1.2 October 2008 states that the organization must restrict physical access to gateways and wireless access points.