POL-15: Physical Security Policy

Purpose

This policy establishes the requirements for protecting physical assets and facilities. It ensures that LNC Nexus systems and data are secured against physical threats.

Scope

This policy applies to all LNC Nexus hosted, private, and self-managed deployments. It covers data centers, workspaces, and equipment.

Policy Statements

Physical access to facilities shall be restricted to authorized personnel. Security measures include locks, alarms, and surveillance. In self-managed deployments, customers are responsible for physical security; LNC Nexus provides the framework but not the enforcement. Regulated data handling requires additional physical controls. No unauthorized person shall enter secure areas.

Roles and Responsibilities

The Security Team defines physical security standards and monitors compliance. Facility managers implement physical security measures. Users follow physical security procedures. System administrators ensure equipment is secured.

Evidence and Review

Access logs, inspection records, and audit reports serve as evidence of compliance. The Security Team conducts periodic reviews of physical security practices and investigates anomalies. Deployment-specific configurations are treated as controlled material.

Exceptions

Exceptions to this policy require written approval from the Security & Compliance owner or delegated risk owner and must be documented with a risk acceptance statement. Exceptions are valid only for a defined period and must be re-evaluated before expiration.

Enforcement

Violations of this policy may result in disciplinary action, up to and including termination, and legal prosecution where applicable. Access may be suspended immediately upon detection of a violation.

Related Policies

POL-1 (Access Control Policy), POL-9 (Asset Management Policy), POL-8 (Information Security Policy).

Revision History