Physical & Environmental Security Policy

Physical & Environmental Security Policy

Document Name: Physical & Environmental Security Policy
Version: 1.0
Approved by: Directors, Immercial Limited
Review Frequency: Annual or upon material change

Purpose

Immercial Limited applies proportionate physical and environmental controls to protect information-processing equipment, devices and other associated assets.

Immercial operates primarily through cloud and SaaS services and does not operate its own data centre, server room or other specialist information-processing facility.

Physical Access and Working Locations

Business devices and information must be used and stored in locations where access can be reasonably controlled.

Users must:

• prevent unauthorised persons from accessing business devices or information;
• secure devices when unattended;
• lock screens when leaving devices unattended;
• keep confidential papers and removable media secure;
• take appropriate care when working from home, client premises, shared locations or while travelling.

Where third-party premises are used, applicable building and physical-access controls are relied upon proportionately.

Equipment Security

Business equipment must:

• be positioned and used so as to reduce unauthorised viewing, access, theft or accidental damage;
• be protected when transported or used away from the normal working location;
• not be left unattended in insecure public locations;
• be stored securely when not in use.

Loss, theft or physical damage affecting business equipment must be reported promptly and managed under the Information Security Incident Procedure.

Environmental and Utility Risks

Immercial considers proportionate risks from fire, water damage, theft, power failure, connectivity failure and other physical or environmental disruption.

Because core information and services are cloud-hosted, continuity is supported through managed service providers, remote-working capability and documented business-continuity arrangements.

Immercial does not operate specialist cabling, server rooms or on-premises infrastructure requiring dedicated environmental controls.

Physical Monitoring and Secure Areas

Immercial does not operate a dedicated secure office, data centre or server facility requiring continuous physical-security monitoring.

Where secure areas or third-party facilities are relevant, access and monitoring controls provided by the facility operator are relied upon and considered through supplier and information-security controls.

Cloud and Third-Party Infrastructure

Physical security of cloud-hosted infrastructure is primarily managed by the relevant service provider.

Immercial remains responsible for selecting appropriate providers and for the devices, access controls and configuration under its own control.

Responsibility and Review

The Directors approve and oversee this policy.

It is communicated to relevant personnel and interested parties where applicable and reviewed annually and following significant changes to locations, equipment, systems, suppliers or risks.