ICT Today

40 I ICT TODAY System and Organization Control Framework—Saas SOC 2 Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 is a framework that helps service organizations put cybersecurity processes and controls in place. The SOC 2 criteria include several considerations to ensure the prevention of intentional or unintentional security events, including: FIGURE 1: To prevent unauthorized users to access the servers and switches in which data is stored, physical access control at the cabinet level is crucial. decisions about physical security. Recognize that the final straw in physical security between data processing and storage equipment and access by unauthorized users is a secure server cabinet. For an enterprise-owned, single-tenant site, for example, room-level security could be considered suffi- cient. Particularly in multitenant data centers (MTDCs) and remote sites, physical access control at the cabinet level simplifies management and prevents unauthorized users to access the servers and switches in which data is stored (Figure 1). Many enterprises would probably argue that they already comply with privacy regulations. After all, most data center cabinets have keyed locks and the keys are carefully controlled. Well, how do they ensure that doors All data privacy standards and regulations require physical access control measures for data processing and storage equipment, but with most regulations, it is up to organizations to decide which specific method or technology to use. • Protection of data whether at-rest, during processing or in-transit. • User identification, authentication, authori- zation and credentials management. • Physical and logical access provisioning and deprovisioning, including remote access. • Operating location and data center physical security and environmental safeguards. Summarizing Requirements In general, compliance to regulations requires a method to: • Physically secure data processing and storage equipment. • Identify and manage authorized accessors. • Manage access to the physically secure space. • Keep records of access to the physically secure space. FIVE CONSIDERATIONS WHEN BUILDING AN ACCESS CONTROL SYSTEM 1. Physical Security: First Line of Defense Because most of the privacy breaches happen in the net- work, little attention is typically paid to physical security. It is important to remember that the intent of data pri- vacy and security regulations is to prevent a data breach. Therefore, preventing a data breach should drive the

• Cover