Are backups tested on a regular basis? When was the last time the backups were restored? Recommendation See recommendation section in the Guided Tour activity. For useful organizational policy recommendations, review the SANSInformation Security Policy Templates OFFICE MAPPING Summary This activity seeks to identify potential physical vulnerabilities to an organization's information security practices by documenting the current physical layout of the office and the locations of key assets, as well as potential "external" risks such as nearby/shared office spaces. This can be done in person independently or alongside the "Guided Tour" activity, and can also be done in advance of an assessment or remotely by a willing staff member who knows where these assets are located (often a technical or administrative staff person). This can also be conducted in a multi-office or home-office environment where the auditor is unable to visit every location. Overview In this activity, the auditor or the organization draws a map of the office space and notes locations of potentially valuable information or assets. This activity can be paired with the Guided Tour activity, to reduce the awkwardness of taking notes while walking around the office during the Tour, and if being done remotely, the two separate activities can be used to cross-verify the accuracy of each. This can also be done by an organizational point of contact in advance to provide additional preparation for the auditor. Materials Needed Page 122 of 240