Will the institution's data be stored on any devices (database servers, file servers, SAN, NAS, etc.) configured with non-RFC 1918/4193 (i.e., publicly routable) IP addresses?
Explanation
The concern here is network exposure, namely whether institutional data lands on devices using publicly routable IP addresses rather than private RFC 1918/4193 ranges.
RFC 1918/4193 define private IP address ranges that are not routable on the public internet. These include:
- 10.0.0.0/8 (10.0.0.0 - 10.255.255.255)
- 172.16.0.0/12 (172.16.0.0 - 172.31.255.255)
- 192.168.0.0/16 (192.168.0.0 - 192.168.255.255)
- fc00::/7 (for IPv6)
Any IP address outside these ranges is considered publicly routable, meaning it can be directly accessed from the internet if not protected by firewalls.
This question is asked in security assessments because storing data on systems with public IP addresses increases the risk surface. Devices with public IPs are directly exposed to the internet and potentially to attackers, whereas devices with private IPs have an inherent layer of protection through network address translation (NAT) and are not directly accessible from the internet.
The best way to answer this question is to:
- Check with your network team to understand the IP addressing scheme for your storage infrastructure
- Verify whether any storage systems holding the institution's data use public IP addresses
- If public IPs are used, explain what compensating security controls are in place (like firewalls, access controls, etc.)
- If only private IPs are used, simply state that
Example Responses
Example Response 1
No, all of our storage systems that will contain the institution's data use RFC 1918 private IP addressing Our database servers use addresses in the 10.45.0.0/16 range, and our file storage systems (NAS/SAN) use addresses in the 172.20.0.0/16 range These systems are not directly accessible from the internet and must be accessed through our secure application layer which implements proper authentication and authorization controls.
Example Response 2
Yes, some of our storage infrastructure does use public IP addresses, specifically our cloud-based database clusters However, these systems are protected by multiple security controls including: 1) IP-based access control lists that only allow connections from authorized sources, 2) a web application firewall, 3) encryption of data both in transit and at rest, 4) multi-factor authentication for administrative access, and 5) continuous security monitoring No direct public access to these databases is permitted - all data access is mediated through our application layer which enforces proper authentication and authorization.
Example Response 3
No, we do not use public IP addresses for any storage systems containing institutional data Our architecture follows a defense-in-depth approach where all data storage systems are placed in private subnets (192.168.0.0/16 range) within our VPC These systems can only be accessed through application servers in a DMZ that implement proper authentication, authorization, and encryption While our web application servers do have public IP addresses to serve content to users, the database and file servers are completely isolated from direct internet access.
Context
- Tab
- Product
- Category
- Data
Related questions
- Is the transport of sensitive data encrypted using security protocols/algorithms (e.g., system-to-client)?
- Is the storage of sensitive data encrypted using security protocols/algorithms (e.g., disk encryption, at-rest, files, and within a running database)?
- Do all cryptographic modules in use in your solution conform to the Federal Information Processing Standards (FIPS PUB 140-2 or 140-3)?
- Will the institution's data be available within the system for a period of time at the completion of this contract?
- Are ownership rights to all data, inputs, outputs, and metadata retained even through a provider acquisition or bankruptcy event?
- Do backups containing the institution's data ever leave the institution's data zone either physically or via network routing?
