f) IT must ensure data centre resiliency, redundancy and fault tolerance should be adequately, such as electrical power, air conditioning, fire suppression and data communications.
g) All computer and telecommunications peripherals must be adequately labeled for proper identification. Power and telecommunications cabling carrying data or supporting information services must be protected from interception or damage.
h) Hardware security modules and keying materials must be physically and logically protected.
31.3 Physical Access Control
Areas identified as sensitive for IT operations must have a clearly defined perimeter that restricts access only to authorized users. These secure areas should have adequate protection against unauthorized physical access to avoid theft or damage. The following mechanisms should be used for protection of sensitive areas:
(i) Security guards
(ii) Automated access control mechanisms like biometric controls or access card controls
(iii) Lock and key
(iv) Surveillance system or Closed-circuit television (CCTV).
(v) Removal or control of other possible physical access points e.g. Ventilation shafts, windows and etc.
(vi) Security Alarm System
Proper identification must be produced in order to access secure areas:-