S 1.45 Suitable storage of business-related documents and data media

Initiation responsibility: Head of Site Technical Service, IT Security Management

Implementation responsibility: Staff members

Business-related documents and data media at the home workstation must only be accessible to the authorised employee, and when they are not in use they must be kept locked in a suitable container.

A lockable container (desk, container on wheels, cabinet or similar) must be available for this purpose. As a minimum, the lock must be capable of withstanding attacks using tools that are easy to create or to purchase (paper clips, picklock etc.) Furniture locks which have at least 4 levers and at least 1,000 key variants should be used. Care must also be taken to ensure that the lock cannot be easily circumvented, e.g. by removing a back panel. The degree of protection provided by the container should be appropriate to the security requirements of the documents and data media contained therein.

Additional controls:

• Is a lockable container available for the home workstation?

• Has the employee been informed that documents and data media need to be stored under lock and key?