PS-01 Physical Security and Environmental Control Requirements

The cloud service provider defines and documents at least two security areas, with at least one sensitive area and one public area. A sensitive area covers the buildings and premises in which sensitive activities take place, such as hosting the system components used for providing the cloud service. A public area covers all buildings and premises not otherwise covered by a security area.

Security requirements for premises and buildings related to the cloud service provided are based on the security objectives of the information security policy, protection needs identified for the cloud service and a risk assessment regarding physical and environmental security. The security requirements are documented, communicated and provided in a policy or framework according to SP-01.

Security requirements for data centres are based on criteria in accordance with established rules of technology and the criteria PS-02 to PS-07. They are suitable for addressing the following risks in accordance with the applicable legal and contractual requirements:

1. Faults in planning;
2. Unauthorised access (including access to the premises by drones);
3. Insufficient surveillance;
4. Lightning and overvoltage (aligned with the internationally harmonised standards of IEC 62305);
5. Fire and smoke;
6. Unwanted water;
7. Failures and/or unavailable telecommunications;
8. Power failure; and
9. Insufficient heating, ventilation, airconditioning (HVAC) and filtration.

The maximum tolerable downtimes of utility facilities are suitable for meeting the availability requirements contained in the service level agreement.

If the cloud service provider operates the cloud service in data centres operated by service organisations, the document describes:

1. The complementary subservice organisation controls (CSOC) expected at the service organisations; and
2. The measures for monitoring the design and operation of controls at the service organisations with respect to these CSOC (cf. SSO-05).

If the cloud service provider operates the cloud service in data centres operated by service organisations, the cloud service provider performs a verification of the implementation of suitable CSOC in accordance with the criteria for controlling and monitoring service organisations (cf. SSO-05).

The security requirements include time constraints for self-sufficient operation in the event of exceptional events (e.g. prolonged power outage, heat waves, low water in cold river water supply) and maximum tolerable utility downtime.

The security requirements include time limits in order to provide self-sufficient operation of a location for at least 72 hours in the event of a failure of the external power supply, or until all services are transferred to another location.

The security requirements for a self-sufficient operation during a heat period are based on the highest outside temperatures that can reasonably be estimated to occur at the locations of the premises and buildings within the lifespan of the cooling supply system. The cloud service provider determines these temparatures with an appropriate safety margin.

The security requirements stipulate that the permissible operating and environmental parameters of the cooling supply system shall also be maintained on at least five consecutive days with these outside temperatures including the safety margin (cf. PS-06).

The security requirements take into account that if water is taken from a body of water (e.g., river or lake) for air conditioning, it is determined at which water levels and water temperatures the air conditioning can be maintained for how long.