Skip to content

12 — Physical Security Policy
Owner Security
Review cadence Annual
Approver CTO
Last reviewed 2026-04
Mapped controls CC6.5

1. Production data centers

TELECOM TOWER POWER operates no on-premises infrastructure. All production workloads run in AWS data centers in São Paulo (sa-east-1). Physical security is inherited from AWS and evidenced by their SOC 2 Type II report (auditor relies on AWS attestation per CC9.2 carve-out).

2. Workforce devices

  • All workforce devices are corporate-managed via MDM (full-disk encryption enforced, screen lock ≤ 5 min, OS patches automated).
  • Personal devices are not permitted access to production data or systems.
  • Lost or stolen devices: report immediately to security@. MDM remote wipe within 1 hour of report. Incident logged.

3. Office security

The company is remote-first; there is no permanent office. When a temporary office or co-working space is used:

  • Visitor access is escorted.
  • Devices are not left unattended.
  • Confidential conversations happen in private rooms.

4. Travel

  • Production access while traveling allowed only over corporate VPN / zero-trust gateway.
  • Devices set to require MFA on every wake; never left unattended.
  • High-risk jurisdictions (per Legal) require pre-travel approval and possibly a clean travel laptop.

5. Disposal

  • End-of-life devices are wiped per NIST SP 800-88 (cryptographic erase or physical destruction for SSDs).
  • Disposal certificate retained for 3 years.