Attachment P PE-03 Policy.pdf
PDF 183 KB Posted
- Solicitation number
- S000000321
- Issued by
- Arkansas
About this file
This document is a policy from the Arkansas Department of Finance and Administration (DFA) Office of Information Services regarding physical access control for information assets. The policy establishes guidelines and requirements to ensure the security of facilities where sensitive information is processed, including restricting access to authorized personnel, maintaining physical access logs, and controlling visitor access. It also details procedures for managing keys, combinations, and access devices, as well as consequences for policy violations. The policy is based on guidance from the IRS Publication 1075 and NIST 800-53 security controls.
The related state and local contract opportunity is for SAP S/4HANA implementation and upgrade services, involving the jurisdictions of Pulaski County and the City of Little Rock. The contract details, such as response dates, award dates, and contract term, are not provided in the given information.
View the file
Other files
Show all 26
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
State of Arkansas
Department of Finance and Administration Office of Information Services
Information Security v.20230331.1 Page 1 of 2
Title: PE-03-Policy: Physical Access Control
Type: POLICY
Scope: All DFA
Last Revised: 1/31/2023 Last Reviewed: 3/31/2023 Review Frequency: ANNUALLY
Owner: Office of Information Services – Information Security
Custodian: Office of Information Services – Information Security
Classification: SENSITIVE
Purpose
The Department of Finance and Administration (DFA) will maintain policies and procedures to ensure the security of agency information assets.
The purpose of this policy is to establish guidelines and requirements that cover physical access control to restricted areas within the Department of Finance and Administration.
Scope
This policy applies to all DFA employees and contractors, and all components of the information system utilized to provide access control.
Policy
DFA shall enforce physical access authorizations at entry/exit points to facilities where information systems receive, process, store, access, or transmit FTI, Social Security Adminis and/or other sensitive information.
• Entry and exit points shall remain locked or have access controlled by an authorized, properly badged individual at the entrance/exit point. Controlled access requires unauthorized visitors to log in with approved identification and documentation describing reason for entrance.
• “Piggy backing” or “tailgating” is expressly prohibited. Piggy backing or tailgating refers to when a person tags along with another person who is authorized to enter a restricted area. Piggy backers have various methods of breaching security which include but are not limited to:
o Following an authorized individual into a restricted location without that authorized knowledge, giving the appearance of being legitimately escorted.
o Joining a large group authorized to enter a restricted location and pretending to be a member of the crowd that is largely unchecked.
• When an unauthorized person is discovered, they should be escorted to the reception area where they can sign the Visitor log and be properly escorted.
• Staff (state and contracted) will “fob” in with their assigned security fob at each secured area they are entering.
o NOTE: if a group is entering at the same time, there is no need to close the door after each person, just ensure each person uses their fob and gets a green light. This function is necessary for monthly auditing.
• All visitors without authorization must be escorted by an authorized individual.
o DFA personnel escorting unauthorized visitors shall be issued and wear a DFA employee identification badge. This badge is to be clearly displayed and worn above the waist.
• Locked doors may be controlled by fob, key, or cypher lock. These locks shall have maintenance performed regularly and be monitored for proper function.
• Physical access logs for restricted areas shall be reviewed monthly for discrepancies or other issues by
OIS Information Security and Office managers and administrators.
o Access logs will be sent monthly by OIS Information Security for review. Possible discrepancies may include access denials for authorized employees, access denials for unauthorized employees, access
State of Arkansas
Department of Finance and Administration Office of Information Services
Information Security v.20230331.1 Page 2 of 2 granted for unauthorized employees, and held open doors allowing multiple personnel in without a fob or access code. Door reports for offices containing FTI are to be retained for 5 years.
• Visitor access and visitor activity shall be controlled to restrict access or restrict activities while temporarily being allowed access. Controls implemented shall be a visitor log to record entry date and time, visitor’s name, ID verification, escort assigned, reason for entry, and time leaving area.
o This log shall be reviewed and verified by office supervisors or administrators monthly.
• Keys, combinations, fobs, cards, or other access devices not assigned to personnel shall be securely stored in a locked area with restricted access. Devices shall only be issued and activated with proper requests completed and approval from OIS Technical Services or OIS Information Security.
• Inventory of keys, cards, fobs, or other access devices shall be inventoried annually detailing device number, personnel assigned to, or storage location. Device inventory shall also be completed as needed due to personnel hiring, termination, or transfers.
o These inventories are to be kept by office supervisors or administrators.
o Any access device assigned to that area or office allowing entrance to the area shall be included on the inventory.
• Keys and combinations to restricted areas accessible with such controls shall be changed annually, or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated. Possible compromises to key or combination security may include, but not be limited to, misplacement of keys for extended period in public place where possible possession can be gained by another individual, loss of written combination code, or inadvertent spillage of code to unauthorized personnel.
Controls and Measures
• Discovered instances of violation of this policy will be investigated in accordance with Incident Response
Procedures.
• Employees or contractors found to be in violation of this policy shall be subject to disciplinary action in accordance with DFA HR policy which may include, but is not necessarily limited to:
o Verbal Warning.
o Written Warning.
o Suspension.
o Termination.
Reference
Guidance for maintenance of this policy shall include but is not necessarily limited to:
• IRS Publication 1075 (https://www.irs.gov/pub/irs-pdf/p1075.pdf)
• NIST 800-53 Security and Privacy Control Framework (https://csrc.nist.gov/publications/detail/sp/800-
53/rev-5/final)
Revision History
4/26/2022 • First Publication
1/31/2023 • Revised to address piggybacking and tailgating.
https://www.irs.gov/pub/irs-pdf/p1075.pdf https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
File details come from the government source that posted it. Updated .