+Physical Security and Environmental Control Requirements

Physical Security and Environmental Control Requirements

Security requirements for premises and buildings related to the cloud service provided, are based on the security objectives of the information security policy, identified protection requirements for the cloud service and the assessment of risks to physical and environmental security. The security requirements are documented, communicated and provided in a policy or concept according to SP-01.
The security requirements for data centres are based on criteria which comply with established rules of technology. They are suitable for addressing the following risks in accordance with the applicable legal and contractual requirements:
• Faults in planning;
• Unauthorised access;
• Insufficient surveillance;
• Insufficient air-conditioning;
• Fire and smoke;
• Water;
• Power failure; and
• Air ventilation and filtration.
If the Cloud Service Provider uses premises or buildings operated by third parties to provide the Cloud Service, the document describes which security requirements the Cloud Service Provider places on these third parties.
The appropriate and effective verification of implementation is carried out in accordance with the criteria for controlling and monitoring subcontractors (cf. SSO01, SSO02).
Additonal CriteriaThe security requirements include time constraints for self-sufficient operation in the event of exceptional events (e.g. prolonged power outage, heat waves, low water in cold river water supply) and maximum tolerable utility downtime.
The time limits for self-sufficient operation provide for at least 48 hours in the event of a failure of the external power supply.
For a selfsufficient operation during a heat period, the highest outside temperatures measured to date within a radius of at least 50 km around the locations of the premises and buildings have been determined with a safety margin of 3 K. The security requirements stipulate that the permissible operating and environmental parameters of the cooling supply must also be observed on at least five consecutive days with these outside temperatures including the safety margin (cf. PS06 Protection against failure of the supply facilities).
If water is taken from a river for air conditioning, it is determined at which water levels and water temperatures the air conditioning can be maintained for how long.
The maximum tolerable downtimes of utility facilities are suitable for meeting the availability requirements contained in the service level agreement.
Supplementary Information - About the CriteriaPremises and buildings related to the cloud service provided include data centres and server rooms housing system components used to process cloud customer data and the technical utilities required to operate these system components (e.g. power supply, refrigeration, fire-fighting, telecommunications, security, etc.). Backup or redundancy computer centres.
Premises and buildings operated by third parties are e.g. server housing, colocation, IaaS.
Premises and buildings in which no data from cloud customers is processed or stored (e.g. offices of the Cloud Service Provider, server rooms with system components for internal development and test systems) are not subject to this criteria area.
The recognised rules of technology are defined in relevant standards, e.g. EN 50600 (facilities and infrastructures of data centres).
Incorrect planning can endanger the operational safety and availability of the premises or buildings. This can result from an incorrect assessment of elementary hazards at the site (e.g. air traffic, earthquakes, floods, hazardous substances) as well as an incorrect conception of the bandwidth or energy supply.
Time specifications for selfsustaining operation as well as maximum tolerable downtimes of utility facilities are typically collected during the business impact analysis (cf. BCM02, BCM-03).

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace