Physical Security Policy

1. Purpose

This policy establishes physical and environmental security controls to prevent unauthorized physical access, damage, and interference to Carriyo's information and information processing facilities. As a cloud-first SaaS company with a primarily remote workforce, Carriyo's physical security posture is centered on endpoint device security, office access controls, and reliance on cloud provider physical security.

2. Scope

This policy applies to:

• All Carriyo office locations (currently: Dubai, UAE headquarters)
• Employee home offices and remote work locations
• All Carriyo-owned or managed physical IT assets (laptops, mobile devices, peripherals)
• Cloud infrastructure physical security (delegated to AWS per shared responsibility model)

This policy does NOT directly cover data center physical security, which is managed by AWS under their SOC 2 Type II certified controls. AWS physical security is validated through our vendor risk assessment process (PRC-006).

3. Physical Security Perimeters (A.7.1)

3.1 Office Security

• The Carriyo Dubai office is located in a managed business center with building-level access controls
• Building access requires key card/fob issued by building management
• Office suite access requires a separate key card issued to authorized Carriyo personnel only
• Visitor access requires escort by a Carriyo employee at all times

3.2 Security Zones

3.3 Cloud Infrastructure

• All production infrastructure is hosted in AWS data centres in eu-west-1 (Ireland), multi-AZ; the pseudonymised analytics copy is held in Google Cloud data centres in europe-west2 (London). A multi-region set-up is offered to customers as an option; no customer is on it today and no second region is deployed.
• AWS data center physical security is validated through AWS SOC 2 Type II report, reviewed annually as part of vendor risk assessment
• AWS controls include: perimeter security, multi-factor access, 24/7 security staff, video surveillance, environmental controls

4. Physical Entry (A.7.2)

• Access to the Carriyo office is restricted to authorized employees and pre-approved visitors
• New employee access is provisioned as part of the onboarding process (PRC-008)
• Access is revoked immediately upon termination (PRC-009 offboarding procedure)
• Visitor log is maintained at the office reception area
• All visitors must sign in, receive a visitor badge, and be escorted at all times
• Access cards that are lost or stolen must be reported immediately to IT for deactivation

5. Securing Offices, Rooms and Facilities (A.7.3)

• Office doors are locked when the last employee leaves
• Sensitive documents must not be left on desks (clean desk policy — see Section 13)
• Meeting rooms with whiteboards must be cleared after use
• Printers and shared devices are located in controlled areas only

6. Physical Security Monitoring (A.7.4)

• Building management provides CCTV coverage of common areas and building entrances
• Carriyo reviews building security reports quarterly as part of facilities management
• Any security incidents involving physical access are reported per the Incident Management Policy (POL-011)

7. Protecting Against Physical and Environmental Threats (A.7.5)

• The Dubai office is in a modern commercial building with fire detection and suppression systems, climate control, and UPS for critical building systems
• AWS data centers are designed with extensive environmental protections (fire suppression, climate control, flood prevention, seismic design as appropriate)
• Carriyo maintains business continuity plans (PRC-002) to address scenarios where the office becomes inaccessible

8. Working in Secure Areas (A.7.6)

• Sensitive discussions should be conducted in closed meeting rooms, not open areas
• Photography of screens or whiteboards containing sensitive information is prohibited
• Personal devices should not be used to photograph or record classified information

9. Clear Desk and Clear Screen (A.7.7)

Clear Desk

• Confidential documents must be locked away when not in active use
• Desks must be cleared of sensitive materials at end of each business day
• Printouts containing sensitive data must be collected immediately from the printer
• Sensitive documents no longer needed must be shredded (cross-cut) or placed in secure disposal bins

Clear Screen

• Workstations must auto-lock after 5 minutes of inactivity (to be enforced via the device management platform once deployed — planned; verified manually until then)
• Employees must manually lock screens (Cmd+L / Win+L) when stepping away
• Sensitive information should not be displayed on screens visible to unauthorized persons
• Screen privacy filters should be used when working in public spaces

10. Equipment Siting and Protection (A.7.8)

• Company laptops must be stored securely when not in use (locked drawer, safe, or taken home)
• Equipment must not be left unattended in public areas (cafes, co-working spaces, vehicles)
• Network equipment in the office (router, switch, access points) must be secured in locked cabinets

11. Security of Assets Off-Premises (A.7.9)

• All Carriyo laptops are encrypted with full-disk encryption (FileVault for macOS, BitLocker for Windows) — enforcement via the device management platform once deployed (planned); verified manually until then
• Laptops taken off-premises remain subject to all security policies
• Loss or theft of any device must be reported immediately to IT and the Information Security Specialist
• Remote wipe capability shall be enabled on all managed devices once the device management platform is deployed (planned); it is not available today
• Employees must not store sensitive data on unencrypted removable media

12. Storage Media (A.7.10)

• Use of USB storage devices is discouraged; cloud storage (Google Drive) is the approved method
• If removable media must be used, it must be encrypted and approved by IT
• Media containing sensitive data must be securely erased (NIST SP 800-88 guidelines) before disposal or reuse
• Failed hard drives are destroyed via certificate of destruction from approved vendor

13. Supporting Utilities (A.7.11)

• Office UPS provides power continuity for network equipment
• Production infrastructure utility management is delegated to AWS (generator backup, redundant power, cooling)
• Internet connectivity: primary business ISP + 4G/5G mobile hotspot as backup

14. Cabling Security (A.7.12)

• Network cables in the office run through contained cable trays and ducts
• Network ports not in use should be disabled or covered
• Wi-Fi uses WPA3 Enterprise with RADIUS authentication where supported
• Guest Wi-Fi is isolated from the corporate network

15. Equipment Maintenance (A.7.13)

• Laptops and devices are maintained per manufacturer recommendations
• Maintenance is performed only by authorized IT personnel or approved service providers
• Before sending a device for repair, sensitive data must be backed up and wiped where feasible
• Maintenance records are retained as part of the IT Asset Inventory (REC-011 / LST-001)

16. Secure Disposal or Reuse of Equipment (A.7.14)

• All data must be securely erased before equipment disposal or reuse per NIST SP 800-88
• For laptops: full disk wipe using manufacturer recovery tools or DBAN
• For failed drives: physical destruction with certificate of destruction
• Asset disposal is recorded in the IT Asset Inventory with disposal method and date
• Disposal certificates are retained for a minimum of 3 years

17. Remote Working Considerations

Given Carriyo's remote-friendly workforce model:

• Employees must ensure their home workspace provides reasonable physical security
• Screens must not be visible to unauthorized household members when displaying sensitive data
• Work devices must be stored securely when not in use
• Sensitive phone/video calls should be conducted in private settings
• Connections to Carriyo systems from untrusted networks must use encrypted (HTTPS/TLS) channels authenticated through Google Workspace SSO (with MFA where enforced); administrative or production operations over public Wi-Fi are prohibited. A VPN for critical systems (AWS infrastructure) is planned and will be mandatory for those systems once in place

18. Enforcement

Violations of this policy may result in disciplinary action up to and including termination of employment, in accordance with the HR Security Policy (POL-010). Significant violations must be reported as security incidents per POL-011.

19. Related Documents

• CAR-ISMS-POL-002: Acceptable Use Policy
• CAR-ISMS-POL-010: HR Security Policy
• CAR-ISMS-POL-011: Incident Management Policy
• CAR-ISMS-POL-018: IT Asset Management Policy
• CAR-ISMS-PRC-002: Business Continuity Plan
• CAR-ISMS-PRC-006: Third-Party Vendor Risk Assessment Procedure (for AWS physical security validation)
• CAR-ISMS-REC-011: IT Asset Inventory Register