IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.17 Entry regulations and controls
Initiation responsibility: Head of Organisational Section; Head of
Site/Bldg Technical Service
Implementation responsibility: Head of Site/Bldg Technical Service; staff
members
Entry into parts of buildings and to rooms requiring protection is to be
regulated and controlled (see S 2.6 Granting of site access authorisations).
The pertinent measures range from the simple issue of keys to intricate
identification systems including one-by-one checks of persons; in this respect,
use of a physical key with lock also constitutes a form of entry control. For
entry regulation and control, it is necessary that:
- The area subject to such regulations must be clearly defined.
- The number of persons with right of access is to be confined to a
minimum. These persons should be mutually aware of their permissions in
order to be able to recognise unauthorised persons as such.
- Any other persons (visitors) may be allowed to enter only after the need to
do so has been previously verified.
- The permissions granted must be documented.
The mere allocation of permissions will not suffice if their observance, or
infringement, is not monitored. The detailed design of control mechanisms
should be based on the principle that simple and practicable solutions are
often just as effective as intricate technology. Examples here are:
- Informing, and raising the awareness of, the authorised persons.
- Full information must be provided on any changes to the permissions
granted.
- Visible carrying of premises passes; possibly issue of visitor's passes.
- Escorting of visitors.
- Procedural patterns when any infringement of rights has been detected.
- Unhindered entry for unauthorised persons must be prevented, or at least
rendered difficult (e.g. door with a dummy knob; lock for authorised
persons provided with a key; bell for visitors).
In addition, the installation of various types of badge readers, of walk-through
detectors and of one-by-one checking facilities may be expedient. For key
management, cf. S 2.14 Key Management.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000