Has your organization implemented physical safeguards to protect equipment from environmental threats such as flooding, fire, wind, excessive heat, and humidity?
Explanation
Environmental threats can cause significant damage to critical IT infrastructure, potentially leading to data loss, service disruptions, and security breaches. Proper physical safeguards such as raised floors in server rooms, fire suppression systems, climate control, and appropriate building construction help mitigate these risks and ensure business continuity during environmental incidents.
Evidence of compliance could include documentation of physical security measures such as floor plans showing raised server rooms, specifications of fire suppression systems, HVAC maintenance records, photos of protective measures, or environmental monitoring system reports that demonstrate how equipment is protected from various environmental threats.
Implementation Example
Protect organizational equipment from known environmental threats, such as flooding, fire, wind, and excessive heat and humidity
ID: PR.IR-02.264
Context
- Function
- PR: PROTECT
- Category
- PR.IR: Technology Infrastructure Resilience
- Sub-Category
- The organization's technology assets are protected from environmental threats
Related questions
- Has your organization implemented network segmentation that separates different trust boundaries and platform types, with controlled communications between segments?
- Has your organization implemented network segmentation to isolate internal networks from external networks, with controls that restrict inbound traffic to only necessary communications?
- Has your organization implemented a zero trust architecture that restricts network access to each resource based on the principle of least privilege?
- Does your organization perform endpoint health checks before allowing devices to access production resources?
- Do you require service providers who operate systems on your behalf to implement protections against environmental threats and maintain adequate operating infrastructure?
- Has your organization implemented redundancy measures to eliminate single points of failure across all critical systems and infrastructure?