PHYSEC-1: Protecting assets

The PHYSEC-1: Protecting assets policy and guidance will assist agencies to achieve an effective protective security outcome within the physical security domain of the TAS‑PSPF. They address core requirement 13 and its supplementary requirements.

The Accountable Authority must identify and implement appropriate physical security measures to mitigate the risk of harm or compromise to its information, people and assets.

To implement appropriate physical security measures to mitigate the risk of harm or compromise to its information, people and assets, the Accountable Authority must:

1. identify, categorise and keep a record of the agency’s assets which require any level of physical protection^[1]
2. implement physical security measures proportionate to the identified threat and likely risk scenario, using the assessed business impact of harm or compromise to agency assets - this may include -
   1. zoning of work areas (e.g. access controls, security screening)
   2. application of required individual control elements (e.g. secure storage, site locations, perimeter measures, security lighting)
   3. separated ICT infrastructure, equipment and facilities
3. certify and accredit all security zones on all premises for which the agency has responsibility^[2]
4. dispose of physical assets securely
5. implement procedures to ensure appropriate accreditation of proposed worksites outside the office. Provide training to all people, in the correct use and application of the agency’s physical security measures.

Agencies must identify the information, people and assets that require protection from compromise and harm. Vulnerabilities will be identified in the agency‑specific risk assessment and managed according to the risk appetite and tolerance of each agency. Implementing layered physical security elements between the public and Tasmanian Government information and assets will enhance protection of the information and the public.

The TAS-PSPF describes how to mitigate identified risks to assets through best practice physical security measures.

1. This will be based on the agency risk assessment and business impact levels.

   [Back]

2. Refer to ASIO Technical Notes to ascertain the requirements of security zones and associated processes. Access is via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

Physical security is a key component of your agency’s protective security regime. It is a combination of physical and procedural measures designed to prevent or reduce the risks of compromise or harm to your information, people and assets.

Adopting physical security measures can assist your agency to:

• keep your people, clients and the public safe
• prevent unauthorised people accessing your information, people and assets
• maintain the trust and confidence of the people, agencies and organisations you work with
• deliver services without disruption in the event of increased threat levels.

To do this, you must know what you need to protect. In the physical security space, threats can come from your own people or from outside the agency. Threats are applicable to your information, people and assets when in the office or the usual place of business. Different threats may apply when your people are working away from the office.

Your agency’s unique context and potential threats determine the physical security measures you need. Taking a risk-based approach will ensure that the physical security measures you implement are right for your agency’s operating environment.

Under the TAS‑PSPF, ‘assets’ refers to an agency’s information, people and physical items, including ICT systems, technology and information infrastructure. Identifying assets which are critical to key functionality and ongoing operations is addressed in TAS-PSPF policy: Security planning (GOVSEC-5).

Identifying your agency’s critical assets enables you to prioritise the application of protections to those assets. Understanding your assets, including their value and sensitivity, is essential to accurately assess your physical security risks.

Physical security measures provide an essential layer of protection that minimises the risks of compromise or harm to your agency’s assets – your information, your people, and your physical items.

Information

Information is a valuable asset and requires protection. The TAS-PSPF policy: Protecting official information (INFOSEC-2) provides guidance relating to the classification, protective marking, transfer, handling and storage requirements of information assets.

The physical security measures applied by an agency, in support of these requirements, will strengthen the protection of information assets, reducing the likelihood of compromise to those assets.

People

An agency’s people are central to its operations and require protection from harm. This policy (PHYSEC-1) reinforces the requirement of the Work Health and Safety Act 2012 that an agency protects its people and others from harm. This is achieved by minimising exposure to risks and providing support in the event of a harmful or traumatic incident.

It is recommended that agencies implement appropriate physical security measures to ensure the personal security of their people, while working in the office and away from the office, to support compliance with the Work Health and Safety Act 2012.

Physical assets

Physical assets are tangible items that are valuable to an agency and require protection. Protection includes ensuring continued operability and accessibility, as appropriate, and preventing any unauthorised access, use or removal.

Categories of physical assets and factors to consider are outlined below.

The protections required for, and that can effectively be applied to, physical assets will be affected by the category of asset and the business impact level of the compromise or loss of, or harm to the asset. The box below will assist you in defining the business impact level of your agency’s physical assets.^[3]

3. The coloured areas relate to information classification; for details, refer to TAS-PSPF policy: Protecting official information (INFOSEC-2).

   [Back]

Your agency may contain various divisions, business areas and alternate sites. These variations are likely to influence the assets held within certain workspaces.

Zoning specific work areas can help you to scale physical security measures based on your security risk assessment.

Security zones are numbered 1-5, with increasing restrictions and access controls as the zone number rises.

Extra physical security measures apply to areas where protectively marked information and other official or valuable assets are processed, handled, and stored. The physical security measures applied to each of these areas are designed to protect the contained items from compromise, either accidentally or maliciously.

Where you identify increased threat levels to your agency’s environment, you must consider what additional measures are required to protect assets and whether a change in zone storage is required.

To aid the ongoing management of physical security in your agency, you must:

• certify and accredit all security zones on all premises for which your agency has responsibility^[4]
• dispose of physical assets securely
• implement procedures to ensure appropriate accreditation of proposed worksites outside the office.
• provide training to all people in the correct use and application of your agency’s physical security measures.

The different security zones are explained below.

Understanding security zones

Zone 1: Public access areas

Public access areas are unsecured zones and include out-of-office working arrangements. They provide limited access controls to information and physical assets and limited protection for people. Storage, handling, processing and discussion of security-classified information should not be conducted within a Zone 1 area, due to the public access in these areas.

Examples of Zone 1 areas include:

• building perimeters and public foyers
• interview and front-desk areas
• temporary out-of-office work areas where your agency has no control over access
• field work, including most vehicle-based work
• public access areas within multi-building facilities (e.g. cafes).

Zone 2: Work areas

Work areas are low-security areas with some controls. This zone is typically the first layer of protection for information, people and assets. Information and assets classified up to and including PROTECTED may be used and stored. Information and assets classified as SECRET may be used, but not stored.

Examples of Zone 2 work areas include:

• normal office environments
• normal out-of-office or home-based worksites where you can control access to areas used by your agency
• interview and front-desk areas where your people are separated from clients and the public
• vehicle-based work where the vehicle is fitted with a security container, alarm, or immobiliser
• exhibition areas with security controls and controlled public access.

Zone 3: Restricted work areas

Restricted work areas are security areas with higher security controls. They provide access controls to information and assets where a loss would result in a business impact up to extreme. Information and assets classified up to and including SECRET may be used and stored. They provide layered protection for people.

Access to this zone is limited according to ‘need to know’ and security clearances – all visitors must be escorted, or closely monitored, and have a business need to access the area.

Examples of Zone 3 areas include:

• storage area for highly valuable assets
• secure areas within an agency building that have additional access controls for your people.

Zone 4: Security areas

These are areas with high levels of security. These areas provide access controls to information where any loss would result in a business impact to extreme and assets where any loss would result in a business impact up to catastrophic. They provide layered protection for people.

People with ongoing access must hold a security clearance. Visitors and contractors must be closely controlled and have a business need to access the area.

Examples of Zone 4 areas include:

• secure areas within your agency’s building/s that have additional access controls for authorised staff
• storage area for highly valuable assets, with additional asset protection controls.

Zone 5: Highly restricted security areas

These are the highest security zones. They are restricted with dual authentication applied to access controls. These areas are likely to contain information and assets with a business impact of catastrophic. Visitors and contractors must be closely escorted and demonstrate a ‘need to know’.

Zone 5 areas include Australian intelligence community facilities.

Zoning control elements

Each of the security zones requires specific control elements to meet the required level of protection. Implementing control elements provides assurance against:

• the compromise, loss of integrity or unavailability of sensitive or security‑classified information
• the compromise, loss or damage of sensitive or security‑classified assets.

Control elements must be in accordance with ASIO Technical Notes^[5] which dictate the minimum requirements to protect sensitive and security‑classified information and assets. For more information, refer to Annexure 1: Physical protections for security zones.

4. Refer to ASIO Technical Notes to ascertain the requirements of security zones and associated processes. Access is via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

5. Access to ASIO Technical Notes is via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

Security Construction and Equipment Committee‑approved equipment

The Security Construction and Equipment Committee (SCEC) is responsible for evaluating security equipment and determining which products will be evaluated and the priority of that evaluation.

The SCEC then assigns evaluated equipment a security level (SL) rating from 1-4, which is based on the level of security it has been assessed to provide, in increasing order. Products rated at SL1 provide the lowest acceptable level of security for government use.

Approved products are listed in the SCEC Security Equipment Evaluated Product List (SEEPL). This is available to government users via the GovTEAMS Protective Security Policy community.^[6]

While it is not a mandated requirement that you use SCEC‑approved equipment, it is recommended that you use SCEC-approved equipment for strengthened protection of your agency’s assets. Alternatively, you can use suitable commercial equipment as long as it complies with the identified security‑related Australian and International Standards for the protection of people, information, and assets.

Security containers and cabinets

Layering your physical security measures includes using security containers and cabinets. Security containers and cabinets can be used to protect information, portable and valuable assets, and money. You must identify the need for, and the most appropriate type of, security cabinets or containers to secure your agency’s assets.

When choosing the most appropriate security container or cabinet, it is recommended that you consider:

• the type of assets (refer to 'Categories of physical assets and factors to consider' above)
• the quantity or size of information and assets
• the location of the information or assets within your facility
• the structure and location of your facility
• the access control systems
• other physical protection mechanisms, for example, locks and alarms.

It is recommended that you store sensitive and security‑classified information and assets in security containers and cabinets separately from physical assets. Ensuring separation decreases the risk of multiple compromises.

For information on selecting security containers to store official information, refer to TAS-PSPF policy: Protecting official information (INFOSEC-2).

Managing security containers and cabinets

If not managed appropriately, security containers and cabinets can be a security risk. It is recommended that keys to security containers and cabinets are secured in key cabinets within an agency’s perimeter and where possible, within the security zone where the containers and cabinets are located.

For containers or cabinets secured with a combination setting, it is recommended that the combination is changed:

• every 6 months
• following repairs
• following change of employees
• when there is reason to believe there has been or may have been a compromise.

SCEC-approved security containers

SCEC‑approved security containers are for the storage of sensitive and security‑classified information and assets. These containers are designed to provide a high level of tamper evidence from covert attack and significantly delay other attacks.

There are 3 levels of SCEC‑approved security containers:

• Class A – protect information with a business impact level of extreme or catastrophic when it has been assessed as high risk. These containers are a significant structure and will not always be suitable in premises with restricted floor loadings.
• Class B – protect information with a business impact level of extreme or catastrophic when it has been assessed as low risk. These containers can also be used to store information with a business impact level of high or extreme when it has been assessed as high risk.
• Class C – protect information with a business impact level up to extreme when it has been assessed as low risk. These containers can also be used for information with a business impact level of medium when it has been assessed as high risk.

Key cabinets

You can use manual and electronic key cabinets to secure keys (e.g. keys for Class C containers or internal offices). These should be located within the security zone or near the zone where the security containers or cabinets are located. Some electronic key cabinets may have an automated audit capacity which means you won’t need to maintain a key register. Electronic key cabinets may also be integrated into your electronic access control system/s.

SCEC have approved various Class B key cabinets; however, these provide the same level of protection as other SCEC-approved Class B cabinets (e.g. filing cabinets and cupboards). SCEC‑approved electronic Class C and B key containers are recommended to store keys for Zones 4 and 5, and for Class C containers.^[7]

Commercial safes and vaults

Commercial safes and vaults provide a level of protection against forced entry. A vault is a secure space that is generally built in place. A safe may be portable and is typically smaller than a vault.  Both safes and vaults provide varying degrees of protection, depending on their construction, use and location. They may both be used to store valuable physical assets.

It is recommended that you seek advice from qualified locksmiths or manufacturers when deciding the criteria to apply to select commercial safes and vaults. Guidance is available in Australian/New Zealand standard AS/NZS 3809-1998 – Safes and strongrooms.

The boxes below may also assist you as you consider commercial safes and vaults for your agency.

6. Access via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

7. For advice, refer to ASIO SEG-013 Electronic Key Cabinets, available via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

8. For information relating to the construction of secure rooms and strongrooms, refer to ASIO Technical Notes: 7-06, 8-06 and 9-06. Available via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

   [Back]

9. For further information, please refer to the National Identity Proofing Guidelines (PDF) on the Department of Home Affairs website.

   [Back]

10. Refer to ASIO Security Equipment Guide SEG-003 Perimeter Security Fences and SEG-024 Access Control Portals and Turnstiles, available via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community. Also refer to AS 1725.1:2010 Chain link fabric fencing – security fences and gates and AS/NZS 3016:2002 Electrical installations – electric security fences.

    [Back]

ICT equipment

Agencies should implement an ICT equipment management policy to ensure that ICT equipment, and the data it processes, stores or communicates, is protected in an appropriate manner.

ICT equipment includes:

• movable physical assets, e.g. computers, photocopiers, multi-function devices, mobile phones, storage media
• system equipment, e.g. hardware and software
• building management systems and security systems.

ICT system equipment is generally operational 24-hours a day and may include:

• servers, e.g. dedicated devices and laptops used as servers
• communication network devices, e.g. PABX systems
• supporting network infrastructure, e.g. cabling, patch panels
• gateway devices, e.g. routers, network access devices.

ICT equipment, as an agency asset, requires specific protection because of:

• the classification of the information held on the asset, the business impact level of compromise or harm to that information, or the classification of the asset itself
• the criticality of integrity or availability of the information held or processed on the asset
• the potential attractiveness of either the information held or the asset in its own right
• the aggregation of information, which may increase the business impact level of the asset’s compromise.

It is recommended that to identify the appropriate physical security measures to protect ICT assets and the information held or communicated on them, you base the level of protection required on the highest business impact level that would result from:

• the compromise, loss of integrity or unavailability of the aggregate of electronic information held on the equipment, or
• the loss or unavailability of the ICT equipment itself.

ICT facilities

It is recommended that you have dedicated ICT facilities to house your agency’s ICT equipment and systems. These facilities may include:

• server and gateway rooms
• data centres
• back-up repositories
• storage areas for ICT equipment that holds official information
• communication and patch rooms.

It is recommended that you locate your agency’s ICT facilities in security zones dedicated to these facilities and separate to other functions. Remember that you must store sensitive or security‑classified information in accredited security zones.

ICT facilities may be housed in a separate security zone, within an existing security zone (i.e. the work area is a Zone 3 and within that Zone 3 is a separate Zone 4 for the ICT facilities). Where ICT equipment is held in one of these separate security zones, the required level of physical security of containers and/or rooms to protect the ICT equipment may be lowered, so long as the security zone is suitable for the aggregation of the information held.

The following table demonstrates storage container requirements for electronic information in ICT facilities.

Access control to ICT equipment and facilities

Agencies must control access to ICT facilities in line with the relevant security zone. In circumstances where the business impact is lower than catastrophic, agencies may consider the following controls to limit access to ICT facilities:

• a dedicated section of the SAS or an EACS
• people physically administering access to authorised people.

When not in use or unattended, ICT equipment must be secured appropriately according to the classification or business impact level of the stored information or asset.

Information sharing is crucial to government business and requires a level of confidence between Tasmanian Government agencies, interjurisdictional and national counterparts. Certification and accreditation of security zones are a means to strengthen the level of confidence in the ability of agencies to share, access and protect information according to classification.^[11]

Certification

Certification of security zones establishes compliance with the minimum physical security requirements to the satisfaction of the relevant certification authority.

Implementation and operation of control elements in Zones 1-4 may be certified by your agency’s Responsible Executive (RE) or delegated Agency Security Advisor (ASA).

Annexure 2 provides a summary of the certification authorities for the relevant control measures.

Accreditation

Accreditation of security zones involves compiling and reviewing all applicable certifications and other deliverables for the zone to determine and accept the residual security risks. Approval for each security zone to operate at the desired, or required level, is only granted for a specified time. For your agency’s Zones 1-5, the RE (or delegated ASA) is the accrediting authority when the controls are certified as meeting the requirements summarised in Annexure 2.

Recertification and reaccreditation

Your agency’s facilities must be recertified and reaccredited by circumstances including:

• expiry of the certification –
  1. Zone 2: 10 years
  2. Zones 3-5: 5 years
• changes in the business impact level associated with the sensitive or security‑classified information or assets stored within the zone
• significant changes to architecture of the facility or the physical security controls used
• any other conditions stipulated by the accreditation authority, such as changes to the threat level or other environmental factors of concern.

11. Refer to ASIO Technical Notes 1/15 and 5/12 to ascertain the requirements of security zones and associated processes. Available via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

    [Back]

When your agency’s building, facilities, information, or assets are no longer needed, you must consider the security implications during the decommissioning and disposal phase.

You must ensure that the disposal of your agency’s physical assets is secure and minimises risk to the Tasmanian Government.

Prior to the decommission or disposal of physical assets, such as containers, cabinets, vaults, strongrooms, and secure rooms, it is recommended that you:

• reset combination locks to the original settings
• visually inspect and remove all contents from physical assets.

You should refer to the Australian Government Information Security Manual^[12] for information on how to sanitise ICT equipment and media before disposal. In some instances, ICT equipment cannot be sanitised and must be destroyed.

12. For further information, please refer to the Australian Cyber Security Centre website.

    [Back]

Working away from the office covers all work undertaken by agency people away from the agency’s facilities and physical locations. When developing working‑away‑from‑the‑office policies and procedures, you should consider the security risks of the environments in which your agency’s people operate, the type of information used and how that information will be accessed.

You must consider the security measures required to enable your agency’s people to work securely when they are working away from the office.

Mobile computing and communications

Mobile computing and communications occur when people are provided access to your agency’s systems and information from locations outside of your agency’s control, using portable devices. Most areas being used for mobile computing and communications (i.e. work from home or mobile work arrangements) are public areas with few, or no, protective security measures in place, and would therefore be rated no greater than a Zone 1 secure area. For this reason, you should implement controls to minimise any residual risk, such as requiring people to carry portable devices at all times; that is, that they are not to be left unattended.

Due to the inherently low security surrounding mobile computing and communications, it may not be possible to implement appropriate zoning requirements away from the office. In these circumstances, you should consider ICT logical security controls to protect your agency’s information and assets. You can find advice on suitable logical controls in the Australian Government Information Security Manual.

Protecting resources while working away from the office

The TAS-PSPF requires agencies to protect their people, information and assets in accordance with the assessed business impact level of compromise or harm. This includes while working away from the office. Your agency should accredit proposed worksites outside of the office in line with the type of work expected to be undertaken.

In determining the feasibility of work away from the office, you must consider:

• if sensitive or security‑classified information can be appropriately secured
• if the work area can be independently secured
• if the work area can be protected from oversight or overhearing by other people
• if the ICT equipment being used can be secured or segregated from the agency’s ICT system.

It may be difficult to secure an agency’s information when the working environment is not controlled or managed by the originating agency. This situation may present when information is stored or used at commercial facilities, private residences or a service provider’s premises.

It is recommended that you consider all areas outside of your agency’s control as Zone 1 unless you can confirm and certify security measures.

Training in physical security measures

In accordance with TAS-PSPF policy: Security awareness (GOVSEC-3), your agency must provide security awareness communications, training and support to help create a strong security culture. It is important that your agency communicates physical security expectations and measures to your agency people, visitors and anyone who performs work within your agency.

Where specific physical security measures exist within your agency, training in the correct use and application is a requirement of this policy (PHYSEC-1). For all other training, please refer to TAS‑PSPF policy: Security awareness (GOVSEC-3).

13. For guidance on alarm systems see Australian Standard AS/NZS 2201.1:2007 – Intruder alarm systems.

    [Back]

14. Refer to TAS-PSPF policy: Access to, and management of, official information (INFOSEC-1) for guidance on short-term access to security-classified resources.

    [Back]

15. Available via GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community.

    [Back]

16. SCEC-endorsed security zone consultants design and commission SCEC Type 1A SAS in accordance with the requirements of the Type 1A SAS Implementation and Operation Guide.

    [Back]

17. Inclusion of an alarm system or EACS in Zones 1 and 2 are at the agency’s discretion.

    [Back]

18. If out-of-hours guard patrols or commercial alarm systems are not used instead.

    [Back]

• Australian Government, GovTEAMS, where users are required to register for an account and request access to the Protective Security Policy community
• Australian Government, Australian Cyber Security Centre, Information Security Manual
• Australian Government, Department of Home Affairs, National Identity Proofing Guidelines (PDF)
• Australian Government, Protective Security Policy Framework - Policy 16: Entity facilities (PDF)
• South Australian Government, PHYSEC 1: Physical Security (PDF)
• Tasmanian legislation, Work Health and Safety Act 2012

First publication: April 2023

Revision: February 2024

Next review date: December 2024

Change log:

• V1.0 April 2023
  • Policy issued
• V2.0 February 2024
  • Definition: 'core requirement' updated
  • Definition: 'originator' updated
  • Definition: 'protected information' removed and replaced with 'security classified'
  • Definition: 'Responsible Executive' added
  • Definition: 'supplementary requirement' updated
  • Removal of reference to T1 alarms – these have been phased out