If alternative processing locations are available, these should be identified in the plan. This will allow easier recovery from a fire, flood, or other disaster that may destroy the unit's site. Units need to protect their informational and physical assets from theft or unauthorized use. To do this, access to equipment must be limited to authorized users. This would include such measures as keeping the equipment in locked rooms and ensuring that remote site access through telephone or network connections is controlled.
Most units have data that is considered sensitive or confidential.
This may include personnel data, employee evaluations, research data, etc. Access to this information should be restricted as needed. This may include storing information off a network, encrypting files, or perhaps making data 'read-only' so that it cannot be altered or deleted. The use of passwords not only helps prevent unauthorized access, but also helps identify those individuals who have had access to data. Whenever two or more people share the same password, it is impossible to determine responsibility for the actions that have been recorded in association with the password.