IMP08: Information Access Control Policy

Physical Access Control

Physical security is protection of information assets against real-world physical threats, such as unauthorised physical access and theft. It typically involves physical controls e.g. protective fencing, barriers, turnstiles and locks, lockable storage, guards, access control cards, CCTV, intrusion detection sensors, external building security, secure doors and windows.

• All University members are issued University identity (ID) cards. These cards control access to University non-public facilities. These cards remain the property of the University and must be returned prior to termination of an individual’s contractual relationship with the University.

• All individuals carrying out work on behalf of the University must wear their ID card visibly when in non-public University facilities.

• ID cards must be issued to all contractors, temporary employees and any other persons who needs access to the University’s non-public premises for any authorised reason, other than members of the emergency services.

• ID cards must be shown upon request to any University member of staff or authorised personnel.

• ID cards (with the exception of temporarily issued visitor passes which will have ‘visitor’ and a valid date visible) must always clearly show the name and a photograph of the true likeness of the card holder. Avatars or similar images will invalidate the card. Any damaged or vandalised cards must be replaced immediately.

• ID Cards are issued to all University members, contractors, temporary employees and others who require access for specific purposes linked to University business and operations and must be returned when individuals leave the University. It is the line manager’s (or individual with equivalent responsibility for temporary visitors) responsibility to ensure these are returned.

• The ID card access expiry date for University members must not exceed the date of the end of the contractual relationship with the University. All access rights must be immediately rescinded upon the end of the contractual relationship.

• Individuals must always keep their ID card in a safe place when not at their place of work or study and must inform Community Safety immediately if they lose their access card, or believe it to be stolen.

• Failure to comply with any of the listed controls related to ID cards may result in disciplinary action being taken. Community Safety reserve the right to remove individuals from University premises in response to instances of non-compliance with these clauses.

• Lockable cabinets, cupboards or drawers may be provided for employees as appropriate so that they can keep personal belongings and information assets secure while they carry out their duties. This must be managed in line with IMST 03 Handling Information Standard.

• Passwords and pins for keypads must be in line with the requirements of IMST 02 Password Management Standard and must be changed in the following circumstances when an employee no longer needs access e.g.:

• When an employee with access changes departments.
• When an employee with access leaves the organisation or where their access is suspected to present a security risk.

• Access to non-public University buildings is controlled, but local controls will vary. ID card readers are located at entry and exit points where required, excluding exits designated for emergency use only. Where necessary, these are also covered by CCTV and are checked regularly by Community Safety. Usage of each ID card reader to gain access is recorded and data for usage retained for 31 days as standard practice or longer for investigation purposes in response to incidents.

• Everyone must be vigilant to the potential for unauthorised people to ‘tailgate’ them (follow an individual through a door or barrier) into an area containing information assets or digital IT infrastructure. If they feel confident to do so, individuals should politely ask for proof of authority when they suspect someone lacks access rights. If they don’t feel confident to do so, they must contact Community Safety.

• Doors to areas with restricted access must be locked if the areas are empty or unsupervised, and they must be closed if data and information of a sensitive nature is being processed. For spaces that require access permits, these must be granted before an individual accesses the space, for example sensitive areas may include:

• Post, server and communications rooms
• Project or business management rooms
• Research laboratories and work areas
• Specific or specialist identified rooms – determined by senior managers

• Filming or taking photos specifically of sensitive information either on-screen or in hard copy is not permitted unless explicitly permitted by the data owner.

• Where filming or photography takes place in proximity or view of sensitive information in any University premises, content must be reviewed by a University member prior to any distribution of the content to ensure that sensitive content has not been captured.

• Where security risks are considered high, the use of CCTV is employed to gather evidence and as a deterrent.

• Camera systems will be reviewed at regular intervals to ensure they are still appropriate for the task and modified to reflect any changes to the building or areas covered by the cameras.

• The Community Safety team have access to CCTV footage and any access beyond that must be agreed by the Data Protection Officer.

Administrative Access Control

• Administrative controls relate to how University members conduct work, ensuring that security is embedded in processes to protect information.

• The IMST 03 Handling Information and IMST 02 Password Management Standards set out further administrative controls that must be met.

• Individuals must not re-use their University credentials or passwords in other applications and systems outside of the University, for example online banking, personal email accounts or social media in line with the IMST02 Password Management Standard.

• Information classified above ‘public’ (see IMST 01: Information Classification Standard) in hard copy or stored on encrypted removable media must be secured when members are not in sight of the hard copy or removable media.

• In the case of members moving between roles in the University, it is the responsibility of the line manager of the post being vacated to ensure that access rights have been rescinded where appropriate.

• Postal/delivery service visitors must follow University procedures and instructions by Community Safety and University reception or porter staff.

• Information classified above ‘public’ (see IMST 01:Information Classification Standard) must be kept out of view of all visitors who have not been given authorisation to access it.

• All visitors to University non-public premises must be issued with a temporary pass which clearly identifies them as a building visitor giving their name, the organisation they represent and an expiry date. All such visits must be logged.

Exceptions

Exception requests under this policy must be submitted to the CISO or their designate. Authority to approve exception requests is delegated to the Information Risk and Compliance Team. Activities that have received prior approval by the Research Governance and Ethics Committee will be exempt, but the CISO must be notified.