## 7.6 Working in secure areas

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|------------------|-----------------------------------------|---------------------------|-----------------------------|----------------------|

| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Physical_security | #Protection |

  

**Control**

  

Security measures for working in secure areas should be designed and implemented.

**Purpose**

  

To protect information and other associated assets in secure areas from damage and unauthorized interference by personnel working in these areas.

  

**Guidance**

  

The security measures for working in secure areas should apply to all personnel and cover all activities taking place in the secure area.

  

The following guidelines should be considered:

  

a\) making personnel aware only of the existence of, or activities within, a secure area on a need-to-know basis;

  

b\) avoiding unsupervised work in secure areas both for safety reasons and to reduce chances for malicious activities;

  

c\) physically locking and periodically inspecting vacant secure areas;

  

d\) not allowing photographic, video, audio or other recording equipment, such as cameras in user endpoint devices, unless authorized;

  

e\) appropriately controlling the carrying and use of user endpoint devices in secure areas;

  

f\) posting emergency procedures in a readily visible or accessible manner.

  

**Other information**

No other information.