1. Physical and Environmental Security Policy v1.0 Classification: Internal Sample Physical & Environmental Security Policy DOCUMENT ID : NN-NNN-NN 1

2. Physical and Environmental Security Policy v1.0 Classification: Internal Version Control Version Date Prepared By Reviewed By Approved By 1.0 dd-mm-yy Change History Version Description of Change 1.0 First release Distribution List 1.Write the target audience who should receive a copy of this document. 2. 3. This document is created by the Azpirantz Marketing Team. For expert consulting aligned with your business needs, please reach out to sales@azpirantz.com. DOCUMENT ID : NN-NNN-NN 2

3. Physical and Environmental Security Policy v1.0 Classification: Internal Purpose The purpose of this policy is to protect the organization's information assets by preventing unauthorized physical access, damage, and interference. It establishes rules and guidelines for maintaining a secure work environment. Scope The scope of this policy pertains to all employees, contractors, and authorized users having access to the organization's information and information processing facilities. Responsibility All employees and contractors are responsible for adhering to this policy. The Head of Facilities and Physical Security are responsible for enforcement of this policy. Policy Statements Physical Security Requirements 1. Security Zones: Define and implement security zones based on asset sensitivity and criticality to protect information and processing facilities. 2. Access Control: Restrict access to secure areas to authorized personnel using appropriate entry controls. 3. Visitor Management: Log and supervise all visitor access. Limit visitor access to specific and authorized purposes. Verify visitor identity using government-issued IDs. 4. Access Logs: Maintain secure access logs (physical or electronic) for at least XX days and review them periodically. 5. Visible Identification: Require all personnel (employees, contractors, and external parties) to wear visible identification. 6. External Support Personnel: Grant restricted and monitored access to external support personnel with appropriate approvals. 7. Physical Security Controls: Implement physical security controls for restricted areas to comply with legal, regulatory, contractual, and business requirements. 8. Protection Against Threats: Implement measures to protect against natural disasters, attacks, and accidents, such as fire, flood, theft, etc. 9. Secure Area Procedures: Define and enforce procedures for working in secure areas. 10. Access Point Control: Control and isolate delivery/loading areas and other potential entry points to prevent unauthorized access to information processing facilities. DOCUMENT ID : NN-NNN-NN 3

4. Physical and Environmental Security Policy v1.0 Classification: Internal Equipment Security Requirements 1. Environmental Protection: Equipment must be sited and protected to minimize risks from environmental threats, hazards, and unauthorized access. 2. Utility Protection: Equipment must be protected from power failures and other disruptions caused by utility failures. 3. Cable Protection: Power and telecommunications cabling carrying data or utility services must be protected from interception, interference, and damage. 4. Equipment Maintenance: Equipment maintenance must be planned and executed to ensure its continued integrity and availability. 5. Off-Site Removal Restrictions: Information processing and support services equipment must not be removed from site without prior authorization. 6. Off-Site Asset Security: Security measures must be applied to off-site assets, considering the additional risks of remote working. 7. Data Sanitization: All equipment containing storage media must be verified to ensure sensitive data and licensed software are securely deleted before disposal or reuse. 8. Unattended Equipment Protection: Users must ensure that the systems allocated to them are appropriately protected. 9. Clear Desk/Screen Policy: A clear desk policy for papers and removable storage media and a clear screen policy for information processing systems must be implemented. Note: This document serves as a sample template. Organizations are required to develop a comprehensive policy that incorporates specific legal, regulatory, contractual, and business requirements. DOCUMENT ID : NN-NNN-NN 4