Requirement
The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.
Points of Focus
Identifies Environmental Threats
Requirement: As part of the risk assessment process, management identifies environmental threats that could impair the availability of the system, including threats resulting from adverse weather, failure of environmental control systems, electrical discharge, fire, and water.
Designs Detection Measures
Requirement: Detection measures are implemented to identify anomalies that could result from environmental threat events.
Implements and Maintains Environmental Protection Mechanisms
Requirement: Management implements and maintains environmental protection mechanisms to prevent and mitigate environmental events.
Implements Alerts to Analyze Anomalies
Requirement: Management implements alerts that are communicated to personnel for analysis to identify environmental threat events.
Responds to Environmental Threat Events
Requirement: Procedures are in place for responding to environmental threat events and for evaluating the effectiveness of those policies and procedures on a periodic basis. This includes automatic mitigation systems (for example, uninterruptable power system and generator backup subsystem).
Communicates and Reviews Detected Environmental Threat Events
Requirement: Detected environmental threat events are communicated to and reviewed by the individuals responsible for the management of the system, and actions are taken, if necessary.
Determines Data Requiring Backup
Requirement: Data is evaluated to determine whether backup is required.
Performs Data Backup
Requirement: Procedures are in place for backing up data, monitoring to detect backup failures, and initiating corrective action when such failures occur.
Addresses Offsite Storage
Requirement: Backup data is stored in a location at a distance from its principal storage location sufficient that the likelihood of a security or environmental threat event affecting both sets of data is reduced to an appropriate level.
Implements Alternate Processing Infrastructure
Requirement: Measures are implemented for migrating processing to alternate infrastructure in the event normal processing infrastructure becomes unavailable. Measures may include geographic separation, redundancy, and failover capabilities for components.
Considers Data Recoverability
Requirement: Management identifies threats to data recoverability (for example, ransomware attacks) that could impair the availability of the system and related data and implements mitigation procedures.
Explanation
Systems must survive physical and environmental hazards such as fire, flooding, and power failure. This criterion covers environmental protections, data backups, offsite storage, and alternate processing infrastructure. Auditors examine how threats are identified and detected, whether backups run and are monitored for failure, and whether recovery infrastructure exists to keep services available.
