Integrated Framework for IT Asset Physical Security: A Risk Management Approach Using NIST and ISO Standards

This study presents a comprehensive approach to IT asset security risk management in physical access control systems, integrating NIST SP 800-116, 800-53, 800-30, ISO 31000, and 27002:2022 standards. Using a mixed-method approach, we conducted interviews, discussion forums, and observations with IT and security professionals in manufacturing and insurance sectors in Indonesia. Our findings reveal seven key factors crucial for physical security of IT assets, including policies, access authorization, and environmental controls. The study proposes a risk assessment model that determines authentication factor levels based on risk severity. Results indicate discrepancies between current practices and recommended security levels, particularly in server rooms and production areas. We provide a set of control recommendations aligned with ISO 27002:2022 to enhance physical security measures. This research contributes to both theory and practice by offering a holistic framework for managing physical security risks in IT environments, particularly relevant for organizations in emerging economies.