Do you require service providers who operate systems on your behalf to implement protections against environmental threats and maintain adequate operating infrastructure?
Explanation
Environmental and infrastructure controls at your providers are what's under review, namely whether you require third parties running systems for you to guard against environmental threats and keep adequate infrastructure. These requirements are essential when outsourcing critical systems or data processing to ensure business continuity and data protection regardless of where systems are physically located.
Evidence could include contractual language with service providers that specifically addresses environmental protections and infrastructure requirements, service level agreements (SLAs) that define minimum standards, or documentation from provider site assessments that verify these controls are in place.
Implementation Example
Include protection from environmental threats and provisions for adequate operating infrastructure in requirements for service providers that operate systems on the organization's behalf
ID: PR.IR-02.265
Context
- Function
- PR: PROTECT
- Category
- PR.IR: Technology Infrastructure Resilience
- Sub-Category
- The organization's technology assets are protected from environmental threats
Related questions
- Has your organization implemented network segmentation that separates different trust boundaries and platform types, with controlled communications between segments?
- Has your organization implemented network segmentation to isolate internal networks from external networks, with controls that restrict inbound traffic to only necessary communications?
- Has your organization implemented a zero trust architecture that restricts network access to each resource based on the principle of least privilege?
- Does your organization perform endpoint health checks before allowing devices to access production resources?
- Has your organization implemented physical safeguards to protect equipment from environmental threats such as flooding, fire, wind, excessive heat, and humidity?
- Has your organization implemented redundancy measures to eliminate single points of failure across all critical systems and infrastructure?