Physical security policy

How we protect the office and the equipment in it. Our SaaS products run mainly in the data centres of hosting suppliers; the office holds our development, CI and network equipment and some servers. It applies to all employees and visitors of the office.

Annex A controls: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8, 7.11, 7.12, 7.13.

Data centres

• Hosting suppliers hold an ISO/IEC 27001 certificate that covers the physical security, environmental protection, utilities, cabling and maintenance of their data centres. The yearly supplier review checks that the certificate is valid (supplier management).
• The rest of this page covers the office.

Physical security perimeters (7.1)

• The office is in the Klokgebouw in Eindhoven (getting around the office). It has three perimeters: the building entrance, the door to our floor and the office door.

Physical entry (7.2)

• The building entrance and the floor door open with a personal building tag. The office door opens with a personal door code or key.
• Tags, keys and door codes are handed out at onboarding under a signed key agreement and taken back or revoked at offboarding (onboarding, offboarding).
• Visitors are received by the employee who invited them and are not left alone in the office.

Securing offices, rooms and facilities (7.3)

• The last person to leave closes the windows, locks the office door and checks that it is locked (leaving the office).
• Calls about confidential matters take place in a meeting room (meeting room reservation).

Physical security monitoring (7.4)

• The building’s access system registers entry with personal tags, and the office door lock registers who opens it.
• Monitoring alerts in Mattermost when the office internet connection or the office servers stop responding.

Protecting against physical and environmental threats (7.5)

• The building manager is responsible for fire safety and the building itself. Office faults go to the building’s maintenance service (maintenance).
• Backups are stored in a different location than the systems they protect (business continuity).

Working in secure areas (7.6)

• The office is our only secure area; this page holds its rules. There are no separate restricted rooms.

Clear desk and clear screen (7.7)

• Lock your computer whenever you leave it, also for a moment (security). Devices also lock themselves when idle (operations security).
• We work paperless. Printouts with internal or confidential information are collected from the printer immediately, are not left on desks and are shredded when no longer needed.

Equipment siting and protection (7.8)

• Servers, storage and network equipment stand inside the locked office.
• Their disks are encrypted, so a stolen disk does not expose data (asset management).
• Drive temperatures in the office machines are monitored and alert when too high.

Supporting utilities (7.11)

• Power and internet come through the building. The power draw of the office equipment is metered.
• After a power loss, servers start again by themselves; CI runners stay off and are started by hand, so the whole fleet does not start at once and trip the circuit breaker.
• A power or internet outage in the office raises the monitoring alerts of 7.4.

Cabling security (7.12)

• The building manager manages the building cabling and the internet uplink. Inside the office, network and power cables stay within the locked office.
• Monitoring alerts on a network link that drops speed or keeps going up and down, which points at a cable fault.
• We do not rely on the building network for confidentiality: traffic between the office and our hosting goes through encrypted connections (TLS or VPN).

Equipment maintenance (7.13)

• A new office machine passes a hardware burn-in and disk check before it is used.
• Infrastructure keeps the firmware and operating system of office machines up to date in scheduled maintenance windows, and monitoring alerts on disk health errors.
• Equipment that goes out for repair leaves without its disks, or with its disks erased (asset management).

Responsibilities

• Office & HR manages building tags, keys and door codes, and the contact with the building manager.
• Infrastructure manages the office equipment, its siting, power, cabling, maintenance and monitoring.
• The Information Security Officer checks the certificates of hosting suppliers in the yearly supplier review.
• Employees follow the clear desk and clear screen rules, accompany their visitors and lock the office when they are the last to leave.

Review: yearly by the Information Security Officer.