Guest user Created: Jun 13, 2016 Last commented: Jun 13, 2016

Risk assessment of outsourced hosting service

In the process of filling in the Risk Assessment Table. We host all of our data and major applications out of two data centres. Our company doesn't own the data centres, we simply pay for their hosting services, and some equipment. In the Infrastructure section of the Risk Assessment, would we include the physical data centres as an asset? The management of the actual physical Data Centres are actually out of our control. We could say that a threat is, for instance, unauthorized access--but the vulnerabilities are minimal as the security at a DC is quite stringent--and not in our direct control. Would such DC, that the corporation does not own, be part of the scope of our Risk Assessment?

0 0

Assign topic to the user

Select user

Expert

Dejan Kosutic Jun 13, 2016

Answer:

This is basically the question of the ISMS scope - you should include in your scope (and therefore in your risk assessment) only the assets you can control. So you should include in your scope/risk assessment the applications and your data on those virtual servers you control, however you should exclude the physical servers because you do not control them.

However, control A.15.1.1 requires you also to perform risk assessment of your suppliers, so this means that you should assess how this hosting service can affect confidentiality, integrity and availability of your data - for that purpose you can use the same Risk Assessment Table, and write as an asset "hosting service". So you won't be assessing the physical servers, but figure out what incidents can happen in general - e.g. unauthorized access to your data, loss of data, unavailability of the service, etc.

These articles can also help you:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jun 13, 2016

Expert Advice Community