PE-3(4)—Lockable Casings
>Control Description
Use lockable physical casings to protect ⚙organization-defined system components from unauthorized physical access.
>Cross-Framework Mappings
>Supplemental Guidance
The greatest risk from the use of portable devices--such as smart phones, tablets, and notebook computers--is theft. Organizations can employ lockable, physical casings to reduce or eliminate the risk of equipment theft. Such casings come in a variety of sizes, from units that protect a single notebook computer to full cabinets that can protect multiple servers, computers, and peripherals.
Lockable physical casings can be used in conjunction with cable locks or lockdown plates to prevent the theft of the locked casing containing the computer equipment.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies and procedures govern the implementation of lockable casings for the organization's facilities?
- •Who is responsible for overseeing and maintaining lockable casings controls?
- •How frequently are lockable casings controls reviewed and updated?
- •What process exists for granting exceptions to lockable casings requirements?
- •How does the organization ensure accountability for lockable casings across all facility locations?
Technical Implementation:
- •What technologies or systems technically implement lockable casings?
- •How are these systems configured to meet the control requirements?
- •What monitoring or alerting capabilities exist for lockable casings?
- •How do lockable casings systems integrate with other physical security infrastructure?
- •What redundancy or backup mechanisms support lockable casings?
Evidence & Documentation:
- •Provide documented policies and procedures for lockable casings.
- •Provide evidence of lockable casings implementation and configuration.
- •Provide logs, records, or reports demonstrating lockable casings activities over the past 90 days.
- •Provide testing, maintenance, or inspection records for lockable casings from the past year.
- •Provide evidence of lockable casings reviews, audits, or assessments.
Ask AI
Configure your API key to use AI features.