De-activate unused network ports Hard-wired network ports tend to connect directly into the most trusted parts of a network. De-activating any that are in public areas of the office (front desk, conference rooms, break rooms), as well as any that are not needed is recommended. OPERATIONAL SECURITY SURVEY Summary This activity helps the auditor assess the organization's current operational security policies and practices through in-person or remote surveys and/or interviews. By also requesting to review and official policies as well as conducting multiple iterations of this with different staff members, some basic verification of the practices and awareness/understanding of existing policies can be achieved Overview The auditor interviews and/or requests survey input from organizational representatives, requests supporting documentation (e.g. policies) as relevant, and iterates/repeats as needed. This activity is used to solidify the auditor's understanding of the physical risks the organization faces in its work as they impact information security: Discuss potential risks and history Explore the physical office setup Determine access controls and related policies (who has access to what, when?) Determine where and when staff members work (office, cafe, co-working spaces, home, on travel/remote assignments) This can be done entirely remotely over secure communications channels (see operational security considerations), and may be useful to be done partially or fully in advance of an in-person audit to further understand operational risks of traveling to the office location. Materials Needed Page 117 of 240