IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Personnel Remarks
____________________________________________________________________ .........................................
S 3.20 Instructions concerning the operation of
protective cabinets
Initiation responsibility: IT Security Management
Implementation responsibility: IT security management, manufacturer
Following the purchase of a protective cabinet, users must be familiarised with
correct operation. This should also occur when a task involving use of the
protective cabinet is reassigned. As a minimum requirement, the following
points must be conveyed:
- Correct procedure with the lock of the protective cabinet must be
demonstrated. Typical errors should be pointed out, for example not wiping
code locks. The rules governing key management, safekeeping of keys and
replacement regulations must be outlined. In particular, individuals must be
called on to lock the protective cabinet when not in use, even for a short
period.
- The keyboard of a server must always be kept in the server cabinet so that
no unauthorised console inputs can be made.
- As far as server cabinets are concerned, it should be pointed out that
unnecessary inflammable materials (print-outs, surplus manuals, printer
paper) should not be kept in the server cabinet.
- Data backup media of the server should be stored in another fire zone.
Keeping them in the server cabinet is therefore inappropriate and only
permissible if a duplicate of the data backup medium is relocated to
another fire zone.
- If an air-conditioned server cabinet is used, the times the server cabinet is
open should be kept to a minimum. Where necessary, sporadic checks
should be carried out to determine whether there is any water condensation
in the server cabinet.
Additional controls:
- Have people in charge of a protective cabinet been familiarised with its
operation?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000