Physical Security Management Guidelines

Physical security of ICT equipment, systems and facilities

Approved 27 October 2011

Version 1.0

 Commonwealth of Australia 2011 All material presented in this publication is provided under a Creative Commons Attribution 3.0 Australia (http://creativecommons.org/licenses/by/3.0/au/deed.en ) licence. For the avoidance of doubt, this means this licence only applies to material as set out in this document.

The details of the relevant licence conditions are available on the Creative Commons website (accessible using the links provided) as is the full legal code for the CC BY 3.0 AU licence (http://creativecommons.org/licenses/by/3.0/legalcode ). Use of the Coat of Arms The terms under which the Coat of Arms can be used are detailed on the It's an Honour (http://www.itsanhonour.gov.au/coat-arms/index.cfm) website. Contact us Inquiries regarding the licence and any use of this document are welcome at: Business Law Branch Attorney-Generals Department 3-5 National Cct BARTON ACT 2600 Telephone: (02) 6141 6666 copyright@ag.gov.au

Document details Security classification Dissemination limiting marking Date of security classification review Authority Author Document status Unclassified Publicly available July 2013 Protective Security Policy Committee Protective Security Policy Section Attorney-Generals Department Approved by PSPC 27 October 2011

Table of Contents
1. Introduction ............................................................................................................................... 1 1.1 1.2 1.3 Purpose ......................................................................................................................................... 1 Audience ....................................................................................................................................... 1 Scope............................................................................................................................................. 1 1.3.1 Use of specific terms in these guidelines .............................................................................. 1 2. Background ................................................................................................................................ 3 2.1 2.2 2.3 3. Why were the guidelines developed? .......................................................................................... 3 Relationship to other documents ................................................................................................. 3 How are the guidelines structured? ............................................................................................. 4

Physical security of ICT equipment .............................................................................................. 5 3.1 3.2 Storage of ICT equipment when not in use .................................................................................. 5 Security of ICT equipment that cannot be kept in security containers or rooms when not in use ...................................................................................................................................................... 5 3.2.1 Equipment with solid state drives or hybrid hard drives ...................................................... 6 3.3 Auditing of ICT equipment ............................................................................................................ 6 3.3.1 Tamper evident seals ............................................................................................................ 6

4.

Physical security of ICT system equipment .................................................................................. 7 4.1 4.2 4.3 4.4 Physical security of servers and network devices......................................................................... 7 Network Infrastructure ................................................................................................................. 7 Deployable ICT systems ................................................................................................................ 8 ICT system gateway devices ......................................................................................................... 8

5.

Physical security of ICT facilities .................................................................................................. 9 5.1 Accreditation of ICT facilities ........................................................................................................ 9 5.1.1 TOP SECRET or codeword information ICT facilities ............................................................. 9 5.2 Access control to ICT facilities and equipment within ICT facilities............................................ 11 5.2.1 Technical surveillance counter-measures ........................................................................... 11 5.3 Outsourced ICT facilities ............................................................................................................. 11 5.3.1 Gateway facilities ................................................................................................................ 11 5.3.2 Datacentres ......................................................................................................................... 12

6.

Protection of information and ICT equipment against environmental or man-made threats ....... 13 6.1 Preservation of ICT equipment ................................................................................................... 13 6.1.1 Uninterruptable and auxiliary power supplies .................................................................... 13 6.2 Protection from environmental or man-made disasters ............................................................ 14 6.2.1 Flooding ............................................................................................................................... 14 6.2.2 Fire....................................................................................................................................... 14 6.3 Backup ICT systems ..................................................................................................................... 14 ii

Amendments
No. Location Amendment

iii

1.
1.1

Introduction
Purpose

The Australian Government physical security management guidelinesPhysical security of ICT (information and communications technology) equipment, systems and facilities provide guidance to achieve a consistent approach to determining physical security controls for ICT equipment, systems and facilities holding Australian Government information.

1.2

Audience
Australian Government security management staff Australian Government ICT security management staff contractors to the Australian Government providing physical security advice and services providers of facilities for Australian Government ICT services and functions, and any other body or person responsible for the security of Australian Government people, information or physical assets.

These guidelines are intended for:

1.3

Scope
Australian Government agencies, or other entities handling Australian Government official information.

These guidelines relate to physical security measures of ICT equipment, systems and facilities within:

In the absence of specific advice in these guidelines agencies should refer to SAI Global - AS/NZS ISO/IEC 27002:2006 Information TechnologySecurity techniquesCode of practice for information security management, Section 9 Physical and environmental security. Note: Where legislative requirements prescribe higher controls than those identified in these guidelines the legislative controls take precedence and are to be applied. Agencies are to protect any information provided by another government in accordance with international agreements, see PSPF Governance Arrangements4.10 International security agreements. These guidelines include advice on the Australian Governments expectations for the protection of Australian information by foreign governments.

1.3.1 Use of specific terms in these guidelines

In these guidelines the use of the terms: need to refers to a legislative requirement that agencies must meet are required to or is required to refers to a control: to which agencies cannot give a policy exception, or used in other protective security documents that set controls.

are to or is to are directions required to support compliance with the mandatory requirements of the physical security core policy, and should refers to better practice, agencies are expected to apply better practice unless there is a reason based on their risk assessment to apply alternative controls.

For details on policy exceptions see the PSPF - Australian Government physical security management protocol (section 1.4). The following terms are also used in these guidelines: Aggregationcompilations of official information that may require a higher level of protection than their component parts. This is because the combination generates a greater value, and the consequence of compromise, loss of integrity, or unavailability creates an increase in the business impact level. Availabilitythe ability of an agency to make information available to conduct its normal business within a predetermined maximum acceptable outage based on the criticality of the information, see Australian Standard HB 292-2006 A practitioners guide to business continuity management section 4.7 for further information. ICT equipmentany device that can process, store or communicate electronic informationfor example, computers, multifunction devices, landline and mobile phones, digital cameras, electronic storage media and other radio devices. ICT system equipmenta subset of ICT equipment that is used to maintain an ICT system for example, servers, communications network devices such as PABX, gateways and network infrastructure such as cabling and patch panelsthis equipment is normally continuously operational.

ICT facilitya building, a floor of a building or a designated space on the floor of a building used to house or process large quantities of data; for example, server and gateway rooms, datacentres, back up repositories, storage areas for ICT equipment, and communications and patch rooms. ICT system a related set of hardware and software used for the processing, storage or communication of information and the governance framework in which it operates. Network infrastructurethe infrastructure used to carry information between workstations and servers or other network devices. For example: cabling, junction boxes, patch panels, fibre distribution panels and structured wiring enclosures. Security container or roomSecurity Construction and Equipment Committee (SCEC) approved A, B or C class container or room, see PSPF - Australian Government physical security management guidelinesSecurity zones and risk mitigation control measures Section 5.13 and 5.14.

2.
2.1

Background
Why were the guidelines developed?

The Australian Government physical security management guidelinesPhysical security of ICT equipment, systems and facilities provide a consistent and structured approach to determining: the level of control required to: meet the assessed risk give suitable protection to information provide assurance to other agencies for information sharing, and

the types of controls that are suitable.

The guidelines will: establish consistent terminology for physical security of ICT equipment, systems and facilities holding Australian Government official information, and give agencies a framework for the assurance needed to share information.

These guidelines recognise that the predominant risks to electronic information (whether held in ICT equipment, systems or facilities) are from: external cyber attackthe minimum mandatory logical controls to counter cyber attacks are detailed in the ISM, and trusted insidersincluding, but not limited to disgruntled or inexperienced users, contractors, and administrators.

The theft or loss of ICT equipment is another risk to electronic information. The controls identified in the ISM are used to mitigate threats to confidentiality, integrity and availability of information held on ICT equipment. Physical security measures also mitigate these risks by restricting access to people with a genuine need to know. Agencies should develop procedures to minimise the risk of oversight of information on their ICT equipment.

2.2

Relationship to other documents

These guidelines support the implementation of the Protective Security Policy Framework (PSPF). They are part of a suite of documents that aid agencies to meet their physical security requirements. In particular, they support and should be read in conjunction with the: PSPF - Australian Government physical security management protocol, in particular Section 8 PSPF - Australian Government physical security management guidelinesSecurity zones and risk mitigation control measures PSPF - Australian Government protective Security governance guidelinesBusiness impact levels PSPF - Australian Government information management protocol, and Defence Signals Directorate (DSD) publication the Australian Government information security manual (ISM) 3

2.3

How are the guidelines structured?

physical security of: ICT equipment ICT systems ICT facilities, and

These guidelines are broadly divided into the following sections:

protection of information and ICT equipment from environmental or man-made threats.

3.

Physical security of ICT equipment

The primary purpose of ICT equipment is to facilitate the processing storage and communication of agency information electronically. ICT equipment that requires protection includes any device which can store information electronically, such as: computersdesktop, laptop or tablet photocopiers, multi function devices (MFDs) and printers fax machines mobile telephones digital cameras personal electronic devices, and storage mediafor example, portable hard drives, USB sticks, CDs, DVDs, RFID tags and systems.

The level of protection that should be given to ICT equipment is based on the higher of: business impact level that would result from the compromise, loss of integrity or unavailability of the aggregate of electronic information held on the equipment, or the loss/ unavailability of the ICT equipment itself. See the PSPF - Australian Government protective security governance guidelinesBusiness impact levels.

3.1

Storage of ICT equipment when not in use

When ICT equipment is stored in dedicated Physical security of ICT facilities the physical security controls should meet those detailed in Table 1Storage requirements for electronic information in ICT facilities. Where ICT equipment is not stored in dedicated ICT facilities agencies should apply the physical security controls detailed in the PSPF - Australian Government physical security management guidelinesSecurity zones and risk mitigation control measures. The physical security controls used are to meet either the requirements of Table 1 or the guidelines as appropriate, or exceed those required when justified by the agency security risk assessment. Where agencies cannot meet the above requirement they are to seek advice from DSD on additional logical or technological solutions that may be available to lower the risks to electronic information when the equipment is not in use. (See below.)

3.2

Security of ICT equipment that cannot be kept in security containers or rooms when not in use

Agencies may not be able to secure some electronic equipment in security containers or rooms when not in usefor example, desktop computers, printers, MFDs. In some circumstances agencies may be able to fit removable non-volatile media (hard-drives) that can then be secured in an appropriate security container when not in use. 5

In cases where the non-volatile media cannot be removed agencies should determine the Zone where the equipment can be kept based on the risks of obtaining information, and the sensitivity of the information attainable, from the equipment. Agencies should seek further advice from DSD on additional logical or technological solutions that may be available to lower the risks to electronic information. Agencies should assess the risk when equipment cannot be secured when not in use, where its compromise could cause loss of integrity or availability of the information held by or accessible through that equipment. Where the business impact of the compromise, loss of integrity or unavailability of the information is very high or extreme, the equipment is to be stored in a Zone Three or above area unless additional logical controls are applied to lower the risks when not in use to a level acceptable to the agency. Where the business impact of the compromise, loss of integrity or unavailability of the information is catastrophic, the equipment is to be stored in a Zone Five area unless additional logical controls are applied to lower the risks when not in use to a level acceptable to the information originator. The logical controls described in the ISM do not constitute sanitisation and reclassification of ICT media. Therefore, the media retains its classification for the purposes of reuse, reclassification, declassification, sanitisation, destruction and disposal as specified in the ISM.

3.2.1 Equipment with solid state drives or hybrid hard drives

Solid state drives and hybrid hard drives cannot be made safe through normal wiping processes when switched off. Agencies wishing to use equipment fitted with solid state drives or hybrid hard drives should seek advice from DSD on other methods of securing these types of equipmentfor example, encryption.

3.3

Auditing of ICT equipment

record the location and authorised custodian, and periodically audit.

For asset control of ICT equipment, agencies should:

The period between audits should be based on the agencys risk assessment with higher risk items audited on a more regular basis. Agencies should, based on their risk assessment, consider visually inspecting ICT equipment as part of their asset control audit to ensure that non-approved devices have not been installed. Agencies are to have procedures for employees to report the loss of ICT equipment.

3.3.1 Tamper evident seals

Agencies may seal access to ICT equipment using Security Construction and Equipment Committee (SCEC) approved tamper evident wafer seals suitable for application to hard surfaces. The use of seals may give a visual indication of unauthorised access into the equipment if the seals are removed or broken. Agencies should refer to the SCEC Security Equipment Catalogue when selecting wafer seals.

4.

Physical security of ICT system equipment

In addition to the ICT equipment mentioned in Section 3, ICT system equipment that needs physical security includes: serversincluding dedicated devices and laptops used as servers other communications network devicesfor example, PABX the supporting network infrastructurefor example, cabling, patch panels, and gateway devicesfor example routers, network access devices.

4.1

Physical security of servers and network devices

Servers and network devices are to be located in security rooms/containers. The level of room/container used should be determined by the business impact of the compromise, loss of integrity or unavailability of the aggregated information accessible from the servers and network devices. Agencies should keep servers and communication network devices in dedicated Physical security of ICT facilities. Agencies are required to apply the controls identified in the PSPF - Australian Government physical security management guidelinesSecurity zones and risk mitigation control measures to protect the information on the servers and network devices not held in dedicated ICT facilities.

4.2

Network Infrastructure

Agency information is communicated through network infrastructure. Where DSD approved encryption is applied the requirements for physical security of network infrastructure can be lowered. Agencies should protect network infrastructure using a mixture of physical security measures and encryption. Agencies are to use Security Zones suitable for the highest business impact of the compromise, loss of integrity or unavailability of information being communicated over the network infrastructure. As it may not be possible to secure all network infrastructure in security containers/rooms agencies are also to meet any system encryption requirements in the ISM. Agencies should determine the level of container required for patch panels, fibre distribution panels and structured wiring enclosures based on: the business impact of the information passing over the connections, and any other controls in place to protect the information.

Panels should at a minimum be in locked containers/rooms to prevent tampering. Agencies lose control of their information when it is communicated over unsecured public network infrastructure or over infrastructure in unsecured areas as they can have no assurance of the physical security of the infrastructure or logical security of the information. Agencies are required to use the encryption standards identified in the ISM for information transmitted over public network infrastructure when the compromise, loss of integrity or

unavailability of the information would have a business impact of high or above. The encryption will sufficiently protect the information to allow it to be transmitted on an unclassified network. Encryption is normally applied at an agency gateway. Agencies are also required to apply the encryption standards identified in the ISM to protect information on their network infrastructure in unsecured areas.

4.3

Deployable ICT systems

Agencies may have difficulty in applying suitable physical security measures when using deployable ICT systems, particularly if deployed into high risk environments. Agencies that use deployable systems are required to seek advice from DSD on suitable logical controls to help mitigate any risks they identify.

4.4

ICT system gateway devices

In addition to the logical controls required in the ISM, agencies are to use physical security measures for their ICT system gateway devices to mitigate the higher business impact from: the loss of the devices, or the compromise of the aggregated information arising from physical access to the devices. Agencies using shared gateways are to apply controls to the gateway appropriate to the highest level of information passing through the gateway. Agencies are to prevent unauthorised access to gateway devices. It is recommended that these devices be located in dedicated Physical security of ICT facilities.

5.

Physical security of ICT facilities

Agencies may use dedicated ICT facilities to house ICT systems, components of their ICT Systems or ICT equipment. These facilities include, but are not limited to: server and gateway rooms datacentres backup repositories storage areas for ICT equipment that hold official information, and communications and patch rooms.

Agencies should pay particular attention to the security of any access points to an ICT facilityfor example, cabling and ducting.

5.1

Accreditation of ICT facilities

ICT facilities are required to be within accredited Security Zones, as detailed in the PSPF - Australian Government physical security management guidelinesSecurity zones and risk mitigation control measures, appropriate for the aggregation of the information held. Also agencies should house ICT facilities in Security Zones dedicated to these ICT facilities, separate to other agency functions. Where an agency outsources its ICT facilities, or uses shared facilities, the agency is required to ensure their information is held in a Security Zone appropriate for the aggregation of information, see Outsourced ICT facilities. Containers used to house ICT equipment in an ICT facility may be at a lower level when the ICT facility is a separate Security Zone within an existing Security Zone that is suitable for the aggregation of the information held. See Table 1Storage requirements for electronic information in ICT facilities.

5.1.1 TOP SECRET or codeword information ICT facilities

All TOP SECRET or codeword information ICT facilities are to be in a separate Zone Five within a Zone Five work area, both of which are to be certified by ASIO-T4. TOP SECRET ICT facilities are to have either a separate zone on the agency EACS and SCEC approved Type 1 SAS, or have their own SCEC approved Type 1 SAS. In addition agencies are required to have DSD to certify all TOP SECRET ICT systems.

Table 1Storage requirements for electronic information in ICT facilities The physical security containers/rooms required for holding ICT equipment can sometimes be lowered according to the following table when ICT facilities are located in an additional Security Zone within the work area Security Zone. Zone One is not to be used for ICT facilities with an aggregation of information with a business impact level of high or above. The table below details the impact of applying the Security-in-Depth principle and provides the revised physical security standard required.
Business impact level of Security Zone of aggregations of electronic the agencys work information area Catastrophic business impact level Extreme business impact level Security container Additional Security Security container or 1 1 or room ordinarily Zone within work room required for ICT required area for ICT facility equipment Zone Five (Must be Class C certified by ASIOT4) Zone Four or above Lockable commercial cabinets Zone Two Zone Three Class B Class C

Zone Five (Must be Class B certified by ASIOT4) Zone Four Class C

Zone Four or above Lockable commercial cabinets Zone Three Zone Two Class C Class B

Very high business impact Zone Four level Zone Three

Class C recommended Class C

Zone Two or above Lockable commercial cabinets Zone Three or above Zone Two Lockable commercial cabinets Class C

Zone Two

Class B

Zone Four or above Lockable commercial cabinets Zone Three Zone Two Class C Class B

High business impact level Zone Three or above Zone Two

Lockable commercial cabinets Class C

No additional zone Lockable commercial required cabinets Zone Three or above Zone Two Lockable commercial cabinets Class C

Medium business impact level or below

Zone Two

Lockable commercial cabinets Class C

No additional zone Lockable commercial required cabinets Zone Two or above Lockable commercial cabinets

Zone One

Note: 1. Lockable commercial cabinets should be used within security rooms to give additional access control to individual pieces of equipment.

10

5.2

Access control to ICT facilities and equipment within ICT facilities

Agencies are to control access to ICT facilities in accordance with the PSPF - Australian Government physical security guidelinesSecurity Zones and risk mitigation measures, Section 5.5Access control and Section 5.7Visitor control. Access to agency ICT facilities holding information, the compromise, loss of integrity or unavailability of which has a lower than catastrophic business impact level should be controlled by: a dedicated section of the security alarm system (SAS), or electronic access control system (EACS) where used, or

a person provided with a list of people with a need to know or need to go into the ICT facility. Agencies are to keep ICT facilities, and security containers within ICT facilities holding ICT equipment, secured when the facilities are not occupied. Agencies may, if warranted by their risk assessment, use no-lone-zones or dual authentification as an additional control for ICT facilities.

5.2.1 Technical surveillance counter-measures

Agencies are to have a Technical Surveillance Counter Measures (TSCM) inspection undertaken for all TOP SECRET and Codeword ICT facilities where regular TS discussions are held within the facility. A TSCM inspection may also be required to provide a high level of assurance that hardware and cabling infrastructure within an ICT facility has not been compromised. Where an agency does not regularly require its ICT facilities to handle TOP SECRET information, the requirement for a TSCM inspection, and the interval between inspections, should be based on the agencys risk assessment, see the PSPF - Australian Government physical security guidelinesSecurity Zones and risk mitigation measures, Section 5.15.4Technical surveillance counter measures and audio security. Agency security advisers should seek further advice from ASIO-T4 - t4ps@t4.gov.au.

5.3

Outsourced ICT facilities

Agencies are to ensure that outsourced ICT facilities meet any controls identified in these guidelines for the protection of the aggregation of information held in the facilities. Information on the inclusion of security requirements in contracts for outsourced functions is available in the PSPF Australian Government governance guidelinesSecurity in outsourced services and functions.

5.3.1 Gateway facilities

ASIO-T4 will certify the physical security measures in DSD certified commercial gateway facilities intended for use by multiple Australian Government agencies as listed in the AGIMO Internet Gateway Reduction Program before being used operationally. Agencies are to seek ASIO-T4 advice on the certification requirements of the physical security measures of any other commercial gateway facilities holding Australian Government official information where the compromise of the confidentiality, loss of integrity or unavailability of the information will have a catastrophic business impact level before being used operationally.

11

Gateway devices are to be given protection commensurate with the business impact of the compromise of the aggregate of the information protected by the devices.

5.3.2 Datacentres
Agencies are to seek ASIO-T4 advice on the certification requirements of the physical security measures of commercial datacentres holding Australian Government official information where the compromise of the confidentiality, loss of integrity or unavailability of the information will have a catastrophic business impact level before being used operationally. Agencies using datacentres are to assess the aggregation of all official information that is held in the datacentre. Agencies employing a shared datacentre arrangement are to liaise with all other agencies using the same datacentre to assess the business impact of the loss of integrity or unavailability of the aggregate of the combined information before being used operationally. Data storage devices are to be given protection commensurate with the business impact of the compromise of the aggregate of the information stored on the devices. Datacentres are selected not only for their ability to provide security of information, but also for their ability to provide continuous availability to information. ANSI/TIA-942 Telecommunications Infrastructure Standard for Data Centers provides four tiers of availability in datacentres. Datacentres that comply with the Standard are available more than 99% of the time.

12

6.

Protection of information and ICT equipment against environmental or man-made threats

Some information held on ICT systems will be required by agencies to enable a return to normal service after an incident. Agencies should determine the availability requirements for their information as part of their disaster recovery and business continuity plans. The impact of the information not being available will influence the measures taken to protect ICT equipment against environmental and man-made threats. For further information see: PSPF Governance Business continuity management, and SAI Global - HB 292-2006 A practitioners guide to business continuity management, section 4.7.

6.1

Preservation of ICT equipment

ICT equipment may require a controlled atmosphere to ensure the integrity of the information held on the equipment. ICT equipment holding information may also require a controlled environment to prevent failure of the equipment and potential loss of information. This may include, but not limited to, controlling: temperature humidity air qualityfor example smoke and dust water, or light.

Agencies should apply controls to meet any ICT equipment manufacturers identified requirements. Advice on preserving electronic information for the future is available from the National Archives of Australia.

6.1.1 Uninterruptable and auxiliary power supplies

Agencies may lose information if ICT systems are unexpectedly shutdown. An uninterruptable power supply (UPS) will allow the agency to turn off systems in a controlled manner or provide power until power to the ICT system is restored. Any UPS used by an agency should provide at least enough power to allow: the controlled shutdown of ICT systems, or the startup of an auxiliary power supply.

ICT equipment also needs protection from power surges (relatively lengthy increases in voltage), power sags and spikes (short very large increases in voltage). Most UPS also give some protection from surges and sags. As most environmental systems rely on mains electricity an auxiliary power supply may assist in maintaining environmental controls. Auxiliary power supplies should be maintained in accordance with the manufacturers directions. 13

6.2

Protection from environmental or man-made disasters

Agencies should identify any threats from environmental or man-made disasters to their ICT equipment in their security risk assessment. As ICT systems may be more sensitive to environmental factors additional risk mitigation measures, over and above those used to protect people and physical assets from harm, may be needed.

6.2.1 Flooding
Water is one of the major threats to any system that uses electricity, including ICT systems. Agencies should site server rooms so that they are protected from flooding. Flooding may be from external sourcesfor example swollen rivers, or internal sourcesfor example burst pipes. Agencies considering locating server rooms in basements should assess the risk of flooding from external or internal sources.

6.2.2 Fire
Agencies should also protect ICT equipment from fire. ICT equipment can be damaged either through direct exposure to flames, or the effects of smoke (poor air quality) and increases in temperature in the general environment. An additional concern to ICT equipment during building fires is the potential for flooding during fire fighting operations. An agency may be able to use alternatives to water-based sprinkler systems, such as CO2 or other gaseous agents, in critical ICT facilities. An agencys decision to use alternatives should be based on the agencys own risk assessment.

6.3

Backup ICT systems

Backup ICT systems can provide an agency with a recover point if their primary ICT systems fail, which can form part of an agencys business continuity and disaster recovery plans. Any backup systems should be, as far as possible, fully independent of the supporting infrastructure used for the primary system so that in case of a failure of the primary ICT system the secondary ICT system does not also fail. Backup ICT systems should be regularly tested to ensure their continued operation. Agencies may use off-site or commercial backup facilities. Agencies should consider dual redundancythat is using two backup facilities, for business critical information and ICT systems. Agencies are required to ensure any commercial ICT facilities they use meet all the security requirements of the PSPF and ISM to protect Australian Government information. An agency that uses a commercial back up facility should consider the aggregation of information held in the facility, not just the agencys information, when determining the levels of physical and logical security needed at the facility. Information on the inclusion of security requirements in contracts for outsourced functions is available in the PSPF - Australian Government governance guidelinesSecurity in outsourced functions.

14