S 1.36 Safekeeping of data media before and after dispatch

Initiation responsibility: IT Security Management

Implementation responsibility: IT users, Mailroom

Adequate access control must be ensured prior to the sending of data media for the period between saving and transport of data on a storage medium. Once the data has been saved, it must be kept locked in appropriate containers (cabinet, safe) until transport. The department responsible for transport and delivery (e.g. mailroom) must be instructed on proper and reliable safekeeping and handling of the data carriers.

Additional controls:

• Have employees been instructed to keep data carriers destined for transport in restricted-access areas?