From 6f255701fed56bc1968e67aaa62770d647d03d4f Mon Sep 17 00:00:00 2001 From: gearnode Date: Tue, 14 Jan 2025 11:01:13 +0100 Subject: [PATCH] Remap phy.rea to phy.fac Signed-off-by: gearnode --- ...001_cloud_datacenter_physical_security.md} | 7 +++- .../PHY.FAC.002_physical_access_control.md} | 16 +++++--- .../PHY.FAC.003_visitor_access_policy.md} | 14 ++++--- .../PHY.FAC.004_virtual_private_network.md | 38 +++++++++++++++++++ 4 files changed, 62 insertions(+), 13 deletions(-) rename controls/physical/{real-estate/PHY.REA.001_cloud_datacenter_physical_security.md => facilities/PHY.FAC.001_cloud_datacenter_physical_security.md} (79%) rename controls/physical/{real-estate/PHY.REA.002_physical_access_control.md => facilities/PHY.FAC.002_physical_access_control.md} (64%) rename controls/physical/{real-estate/PHY.REA.003_visitor_access_policy.md => facilities/PHY.FAC.003_visitor_access_policy.md} (59%) create mode 100644 controls/physical/facilities/PHY.FAC.004_virtual_private_network.md diff --git a/controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md b/controls/physical/facilities/PHY.FAC.001_cloud_datacenter_physical_security.md similarity index 79% rename from controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md rename to controls/physical/facilities/PHY.FAC.001_cloud_datacenter_physical_security.md index df6dc7713..bc14c5ef9 100644 --- a/controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md +++ b/controls/physical/facilities/PHY.FAC.001_cloud_datacenter_physical_security.md @@ -1,14 +1,17 @@ --- -id: "PHY-REA-001" -category: "physical/real-estate" +id: "PHY.FAC.001" +category: "physical/facilities" revision-version: 1 revision-date: "2024-01-13" estimate-time: "15m" +necessity: "optional" frameworks: - name: "soc2" sections: ["CC6.4"] --- +# Cloud datacenter physical security + ## Purpose You know how critical a data center is. You don’t want unauthorized people to diff --git a/controls/physical/real-estate/PHY.REA.002_physical_access_control.md b/controls/physical/facilities/PHY.FAC.002_physical_access_control.md similarity index 64% rename from controls/physical/real-estate/PHY.REA.002_physical_access_control.md rename to controls/physical/facilities/PHY.FAC.002_physical_access_control.md index 361535985..4214fc687 100644 --- a/controls/physical/real-estate/PHY.REA.002_physical_access_control.md +++ b/controls/physical/facilities/PHY.FAC.002_physical_access_control.md @@ -1,14 +1,17 @@ --- -id: "PHY-REA-002" -category: "physical/real-estate" +id: "PHY.FAC.002" +category: "physical/facilities" revision-version: 1 revision-date: "2024-01-13" estimate-time: "30m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC6.4"] --- +# Implement Physical Access Control + ## Purpose Even if you do most of your business online, you still have offices, computers @@ -17,9 +20,10 @@ secured (we will focus on the digital access later). ## Implementation -If you are working from a coworking space or subleasing offices, you don’t have -much do to. Provide a link to their access policy and the dashboard they -probably provide to manage the list of authorized personnel. +If you are working from a co-working space or subleasing offices, you +don’t have much do to. Provide a link to their access policy and the +dashboard they probably provide to manage the list of authorized +personnel. If you have your own office space, you need to provide: @@ -29,5 +33,5 @@ If you have your own office space, you need to provide: ## Evidence -- Access policy document from your coworking provider. +- Access policy document from your co-working provider. - Screenshot of the dashboard with a list of authorized personnel. diff --git a/controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md b/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md similarity index 59% rename from controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md rename to controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md index f28bf046e..5a75d7cea 100644 --- a/controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md +++ b/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md @@ -1,19 +1,23 @@ --- -id: "PHY-REA-003" -category: "physical/real-estate" +id: "PHY.FAC.003" +category: "physical/facilities" revision-version: 1 revision-date: "2024-01-13" estimate-time: "15m" +necessity: "mandatory" frameworks: - name: "soc2" sections: ["CC6.4"] --- +# Implement Visitor Access Policies + ## Purpose -Even if you do most of your business online, you still have offices, computers -or even printed document: you need to make sure those assets are physically -secured (we will focus on the digital access later) regarding visitors. +Even if you do most of your business online, you still have offices, +computers or even printed document: you need to make sure those assets +are physically secured (we will focus on the digital access later) +regarding visitors. ## Implementation diff --git a/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md b/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md new file mode 100644 index 000000000..a5ff0260a --- /dev/null +++ b/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md @@ -0,0 +1,38 @@ +--- +id: "PHY.FAC.004" +category: "physical/facilities" +revision-version: 1 +revision-date: "2024-01-13" +estimate-time: "4h" +necessity: "optional" +frameworks: + - name: "soc2" + sections: ["CC6.1", "CC6.6", "CC6.7"] +--- + +# Use VPNs to Secure Access for Remote Devices + +## Purpose + +In short, implementing a VPN will encrypt your data and ensure a safe +transmission between your employees devices and your internal network +(even when using untrusted networks like a public wifi) ⇒ it offers a +layer of security for your data. + +## Implementation + +> If you have doubt whether you should do it or not, ping us on +> Discord. +
+> If everything is on Google Suite/Notion/Slack with MFA and you don’t +> have your own network => no needed. + +If you think you need one, you should consider deploying one and make +it mandatory when working remote => You can follow the [Wireguard +installation guide there](https://www.wireguard.com/install/). + + +## Evidence + +- Screenshot of VPN settings page (to show active use) or log of VPN + connection from employees device.