1 Purpose
This policy protects Tree (tree.com.hk) data assets through physical security and environmental safeguards at offices, server rooms, and other locations where company equipment and information are stored.
2 Scope
| System / Asset | Description |
|---|---|
| File Server | Central storage for company files and shared data |
| QuickBooks | Accounting and financial records |
| POS System | Point-of-sale terminals and transaction data |
| Online Sales System | E-commerce and online order processing |
| Office Users + PCs | Staff workstations (tree.com.hk accounts) at office locations |
Also covers the HQ office server room (where the file server is located), network equipment, and any storage media connected to the above systems.
3 Physical Security Controls
3.1 Access Control
- Server room is located at the HQ office.
- Physical access managed by Admin.
- Unauthorized persons must not enter without approval.
- Visitors must sign in and be accompanied in sensitive areas.
3.2 Equipment Protection
- File server and network equipment in locked/controlled area.
- POS terminals positioned to prevent tampering.
- Office PCs must not be left unattended in public areas.
- Lock devices when stepping away.
3.3 Clear Desk & Screen
- Confidential documents not left on desks when unattended.
- Screens locked when not in use.
- Sensitive papers stored securely or disposed properly.
3.4 Asset Disposal
- Old equipment and media wiped or destroyed before disposal/reuse.
- Disposal handled by IT or an approved vendor.
4 Environmental Controls
4.1 HQ Server Room
The file server and related network equipment are housed in the server room at HQ office. Physical and environmental monitoring is handled by Admin:
- Suitable temperature and humidity
- Fire detection or suppression where required
- UPS to allow safe shutdown during power loss
- Protection against water damage and physical hazards
IT is responsible for technical operation; Admin is responsible for premises and environmental conditions.
4.2 Office and POS Areas
- Office PCs should be connected to stable power and company network.
- POS terminals should have reliable power and network connectivity.
- Online sales system hosting must meet vendor environmental and uptime requirements.
5 Responsibilities
| Role | Responsibility |
|---|---|
| Management | Approve physical security measures for company premises |
| Admin | Manage physical access, visitor control, and environmental monitoring of the HQ server room |
| IT Team | Maintain server and network equipment; manage equipment disposal |
| End Users | Lock devices, protect company assets, and report security concerns |
6 Review
This policy will be reviewed at least once per year.