Physical Security

Cybersecurity begins with physical security. This article goes over Dartmouth's physical access control policy and steps that can be taken by Dartmouth employees to ensure that physical security is maintained.

• Dartmouth's physical access control policy
• ID Badges
• Devices
• Documents and Sensitive Information

Dartmouth's physical access control policy

• Establishes a standard for Dartmouth Facilities used for academic or administrative purposes, requiring electronic access controls for all exterior door
• Authorized users are granted access via an Electronic Access Control System, using a combination of physical controls and identification processes to manage access to Dartmouth facilities
• The full policy can be viewed here

ID Badges

• Protect all ID badges, access cards, and keys
• Do not share access credentials
• Report any misplaced access items immediately
• Always use your own ID badge when entering secured area
• Avoid tailgating - entering a secured entryway behind someone else without using your own ID badge

Devices

• All devices should be passcode/password protected
• Lock the screen on your device when away from your desk
• Device encryption
  • Encryption should be enabled on all devices used for work
  • All devices managed through Dartmouth's Device Assurance Program (DAP) have encryption enabled by default
  • If you are uncertain whether your device is enrolled in DAP, or if you need assistance turning on disk encryption on a device, you can submit a request for assistance.
• Keep track of your devices when traveling or in public places
• If your device is stolen or goes missing, report immediately via TDNext or by sending an email to information.security@dartmouth.edu 

Documents and Sensitive Information

• When you leave for the day, make sure any sensitive documents or drives are stored in a locked room/cabinet
• Remove sensitive information from whiteboards and tables in private and shared spaces
• Immediately pick up any documents after they are printed or copied
• Shred sensitive documents when you no longer need them
• Limit physical access to sensitive documents so only those who need access have it
• Maintain a record of all devices, physical documents, etc. that contain sensitive information