Download: PHYSEC1 Guidance (PDF, 1.3 MB)

Date of first approval: 20 April 2020

Date of review: 26 October 2022

Next review date: December 2024

Purpose

Agencies have a responsibility to ensure their people, information, and assets (resources) are protected from harm, including compromise. This policy ensures agencies take the necessary steps to minimise physical security risks to an agency’s resources, while also ensuring agencies incorporate protective security requirements into the planning, selection, design, and modification of their facilities.

Core Requirement

Implement physical security measures that minimise the risk of harm or compromise to people, information and physical assets

Supporting Requirements

To ensure physical security measures minimise the risk of harm or compromise to people, information and physical assets, agencies ^[1] must:

1. identify and categorise the agency’s resources that require a level of physical protection
2. incorporate protective security in the process of planning, selecting, designing and modifying agency facilities
3. implement physical security measures proportionate to the assessed business impact of harm or compromise to agency resources, including:

   a. zoning all work areas

   b. applying all required individual control elements

   c. ICT equipment and facilities

4. certify and accredit all security zones

   a. ensuring areas where sensitive or security classified information is used, transmitted, stored or discussed are certified in accordance with the applicable ASIO Technical Notes ^[2]

5. dispose of physical assets securely
6. manage security risks associated with working away from the office

^{[1] This policy applies to all South Australian public sector agencies (as defined in section 3(1) of the Public Sector Act 2009) and to any other person or organisation that is generally subject to the direction of a Minister of the Crown; all of which are referred to in this policy as “Agencies”.}

^{[2] ASIO Technical Notes are available via GovTeams. Users will be required to register and request access to the Protective Security Policy community.}