Site Visit Checklist

• Audit Title

• Document No.

• Client / Site

• Conducted on

  Date

• Prepared by

• Location
  Address

• Personnel

• Enter general notes about this visit

OBSERVE AS YOU ARE ENTERING THE MAIN LOBBY

• Does the main lobby contain a reception or a security desk a physical person (security guard/receptionist) who manages visitors?

  Yes

  No

  N/A

• Does the main lobby have a console area with a central access terminal to register and issue temporary visitor badges?

  Yes

  No

  N/A

• Are visitors required to sign a visitor control log, provide a government issued ID, be escorted beyond enterance, and required to wear a badge?

  Yes

  No

  N/A

• Does the main entry contain a card reader on exterior as well as a man trap for after hour employee entry when 7x24 staffing is not in place?

  Yes

  No

  N/A

• Is there CCTV camera coverage of main entry, console and lobby?

  Yes

  No

  N/A

OBSERVE AS YOU ARE WALKING THROUGH THE SITE

• Are emergency only exits identified and alarmed on a 7X24 basis?

  Yes

  No

  N/A

• Are all manned computing facilities equipped with emergency lighting?

  Yes

  No

  N/A

• Are all critical support areas equipped with smoke and fire detection?

  Yes

  No

  N/A

• Are there fire extinguishers clearly marked in facilities without automatic fire suppression?

  Yes

  No

  N/A

OBSERVE IN THE UTILITY/EQUIPMENT/COMPUTER ROOMS

• Is access to facilities that are dedicated to computer processing (i.e., data centers, computer rooms) protected by a range of physical controls?

  Yes

  No

  N/A

• Are telecommunications cables, wiring closets and networking lines carrying data or voice protected from interception or damage?

  Yes

  No

  N/A

• Are critical information systems protected from power failures by using multiple feeds, uninterruptible power supply (UPS) or a backup generator?

  Yes

  No

  N/A

• Is emergency equipment, such as UPS and backup generators, serviced in accordance with the manufacturer's recommendations and tested periodically?

  Yes

  No

  N/A

• Have computing facility managers implemented water and moisture detection systems?<br>

  Yes

  No

  N/A

OBSERVE IN THE COMPANY POD

• Are cell phones (with or without cameras), personal laptops and iPads seen in the Company Pod?

  Yes

  No

  N/A

• Are printed materials and media securely disposed?<br>(cross-shredding or burning, etc.)

  Yes

  No

  N/A

• Are all desks clean and are computers not being used locked via a password protected screen saver, etc.?

  Yes

  No

  N/A

SIT DOWN WITH A COMPANY CONTRACTOR & VALIDATE/VERIFY

• Are administrative privileges restricted to those responsible for system administration?<br>Ask for user to logon and view local access permission.

  Yes

  No

  N/A

• Can the user connect to the local/zoned vendor network from the Company system?

  Yes

  No

  N/A

• Are users allowed to print out Company data they have access to?

  Yes

  No

  N/A

• Can user copy paste Company information from their virtual session to a local session?

  Yes

  No

  N/A

• Are users allowed to copy to a removable (like a CD/USB Drive) or remote media (local network drive), the Company data they have access to?<br>Are all drives disabled on workstations?

  Yes

  No

  N/A

• Are unique user IDs used for access?<br>Have a couple of Company contractors log in and make sure they log in within unique IDs.

  Yes

  No

  N/A

• Is wireless networking technology used?<br> - Screen shot of wireless networks available for rogue wireless detection. <br> - Validate that workstations in Pod do not have wireless hardware or that connectivity is disabled.<br> - Try to connect to the wireless via one of the systems in the Pod.

  Yes

  No

  N/A

INTERVIEW SESSION WITH SITE POINT OF CONTACT

• Are physical access audit logs maintained in either electronic or printed form and protected commensurate with requirements for confidential information?<br>Review Visitor Log for Company Pod for the last 30 days.

  Yes

  No

  N/A

• Are visitor control logs retained for at least one year?

  Yes

  No

  N/A

• Are individuals NOT displaying access badges reported?

  Yes

  No

  N/A

• Are fire detection systems connected to local alarms, as well as alarms at the local fire department or 24 hour security center?

  Yes

  No

  N/A

• Are personnel aware of their company's Security Policy and have they completed their annual training? <br>Interview and verify records for the Security Policy training.

  Yes

  No

  N/A

OBSERVE AS YOU ARE LEAVING THE MAIN LOBBY/EXITING THE BUILDING

• Are visitors asked to surrender the badge before leaving the facility or at the date of expiration?<br>Are you asked to surrender your badge?<br>

  Yes

  No

  N/A

• Are delivery and loading areas isolated from general areas or monitored to prevent any unauthorized access to business or secure areas?

  Yes

  No

  N/A

• Does Closed Circuit Television (CCTV) monitor for coverage of main secondary (non manned) entry points, loading dock and parking?

  Yes

  No

  N/A