CONS-06

Will the consultant require access to hardware in the institution's data centers?

Explanation

Physical access risk is what's being assessed: whether consultants engaged by your organization will need hands-on access to equipment inside the institution's data centers.

Why it's asked: Physical access to data center hardware represents a significant security risk. Anyone with physical access to systems could potentially:
- Install unauthorized hardware or software
- Extract sensitive data directly from storage media
- Tamper with hardware configurations
- Disrupt operations by disconnecting or damaging equipment

Institutions need to know if consultants require physical access to properly plan for:
- Escort procedures for visitors
- Temporary access badge provisioning
- Physical security monitoring
- Documentation of who accessed what equipment and when

How to answer: Be specific about whether consultants need physical access, what type of access they need (supervised vs. unsupervised), what systems they need to access, and why this access is necessary for the services being provided. If possible, explain any mitigating controls that will be in place during access.

Example Responses

Example Response 1

No, our consultants will not require physical access to hardware in the institution's data centers All consulting services will be delivered remotely through secure VPN connections to your systems Our consultants are trained to perform all necessary configuration, troubleshooting, and implementation tasks through remote access tools If hardware issues are identified that require physical intervention, we will coordinate with your internal IT staff to perform the necessary actions under our guidance.

Example Response 2

Yes, our consultants will require limited, supervised access to hardware in the institution's data centers This is necessary for the initial hardware installation phase of our project, which includes physical setup of specialized network monitoring appliances and their integration with your existing infrastructure All consultants requiring access will have undergone background checks, will be escorted by your staff at all times, will only access pre-approved hardware components, and will follow all your organization's physical security protocols We estimate needing this access for approximately 3 days at the beginning of the project and potentially 1 day at project completion.

Example Response 3

We're unable to determine at this time whether our consultants will need access to hardware in your data centers Our standard approach is to perform all work remotely, but depending on the specific network configuration issues we encounter during implementation, we may need to request physical access to troubleshoot hardware-level problems If this becomes necessary, we would submit a formal request detailing which consultant needs access, what specific hardware they need to access, and why remote troubleshooting is insufficient This approach doesn't meet the requirement for a definitive answer, as we should have determined our access needs during the pre-engagement assessment phase.

Context

Tab: Case-Specific
Category: Consulting Services