UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.4-RA: Physical security risk assessment for information

Physical and environmental controls for SNI are layered and based on a clearly scoped risk assessment in line with national protective security authority guidance, fed by asset identification and classification and done early in new projects. On nuclear premises it sits within the overall site physical security assessment for theft and sabotage (FSyP 6). It reflects the insider threat, starts with a specification of needs (such as an Operational Requirement), covers assets such as data centres, system management areas, security management systems, workstations, hard-copy storage, removable media and mobile devices in office and remote settings, and uses a suitable method (for surreptitious attack, the Surreptitious Threat Mitigation Process). It considers forced and surreptitious threat, personnel and visitors, the information lifecycle, remote working, data transfer and natural hazards, and links to business impact assessments.