The organization stores paper documents and other non-digital information:

• in a suitable office cabinet within a security area or administrative area, or
• temporarily outside security areas if the information handler has committed to following the compensating measures specified in the issued security instructions.

The organization stores digital information:

• in a compliant device or electronic medium within a security area or administrative area, or
• outside security areas, in a compliant terminal device or electronic medium located in a supervised space or in a suitable locked office cabinet, security bag, or in an equivalent manner.

If the area does not have a storage solution assessed as sufficient for information storage, the walls, floor, ceiling, windows, and doors of the area must meet at least the RC3 class of the SFS-EN-1627 standard.

If a locked office cabinet is used as the storage unit for classified information, it must be ensured that any intrusion attempt leaves visible signs of forced entry.

The organization stores paper documents and other non-digital information in an appropriate storage solution within a security area.

The organization stores digital information:

• in a compliant device or electronic medium within a security area, or
• outside security areas, in a compliant terminal device located in a supervised space or in a suitable locked office cabinet, security bag, or in an equivalent manner.

International classified information of classification level III (confidential) may not be stored in an administrative area.

Each security area must have defined security procedures to be followed. These procedures must include instructions on:

• storing and processing information within the area, including the classification levels of information that may be handled or stored there
• applicable monitoring and protective measures
• granting access rights to the area, specifying the individuals who may enter without an escort based on special authorization and verified reliability
• visitor management, including procedures for using escorts or protecting classified information when access is granted to other individuals
• other relevant measures and procedures.

The keys or access codes for storage units may only be held by individuals who have a need to know the information stored in the unit. These individuals must memorize the number combinations.

The number combinations for storage units containing classified information must be changed:

• when factory codes are replaced upon receipt of a new secure storage unit
• whenever there is a change in personnel who know the combination
• whenever the information has been compromised or is suspected to have been compromised
• whenever one of the locks has been serviced or repaired.