Datacentre

DC-1: Separate hosting

Group: Datacentre

Control Statement

Physically separate Government resources from non-Government resources.

Control Recommendations

For on-premise environments, ensure government resources are physically stored and secured separately from non-government resources.

Risk Statement

Violating this control can subject government data and systems to access risks leading to compromised systems and data.

DC-2: Physical Access Controls

Group: Datacentre

Control Statement

Implement physical access controls to prohibit unauthorised access to the hosting environment or network rooms.

Control Recommendations

Measures to consider include:

a) personnel security clearance and checks

b) Continuous monitoring

c) Immediate security response

d) Strong authentication card access system to regulate and log access of employees, visitors and contractors to the facility;

e) Guards deployed to guard the facility 24/7;

f) Restrict items (such as unauthorised computing devices) to be brought into the facility;

g) Intrusion Detection System installed to detect unauthorised access;

h) CCTV installed to monitor the facility.

Risk Statement

Violating this control can subject government data and systems to access risks leading to compromised systems and data.