Certifications and Audits

Payment Card Industry Data Security Standard (PCI DSS)

The Payment Card Industry Data Security Standard (PCI DSS) was created to meet the rising threat to individuals’ payment card information. Compliance with PCI DSS is mandatory for all organizations dealing with credit, debit and ATM cards, as defined by the PCI Security Standards Council, which includes industry giants like Visa, Master Card and American Express.

PCI DSS is a comprehensive set of standards requiring merchants and service providers that store, process, or transmit customer payment card data to adhere to strict information security controls and processes. The standard includes twelve requirements that include the following:

• Security management
• Policies and procedures
• Network architecture
• User access management
• Network and systems monitoring
• Software development

CyrusOne provides physical security access to customer equipment through a combination of management systems and physical access safeguards and procedures. CyrusOne does not monitor or have access to customer data, so applicability is only to physical security and management processes that govern physical security.

Health Insurance Portability and Accountability Act (HIPAA)

The Health Insurance Portability and Accountability Act (HIPAA) regulation impacts those in healthcare that exchange patient information electronically. HIPAA regulations were established to protect the integrity and security of health information, including protecting against unauthorized use or disclosure of the information.

HIPAA states a security management process must exist in order to protect against “attempted or successful unauthorized access, use, disclosure, modification, or interference with system operations.”

HIPAA sets the standard for protecting sensitive patient data. Data centers must have certain administrative, physical and technical safeguards in place, according to the U.S. Department of Health and Human Services.

With colocation experts and secure facilities, staffed 24×7, CyrusOne can support your HIPAA compliance needs. CyrusOne meets required physical and administrative security controls, supporting your HIPAA physical security compliance through the following deliverables:

• Controlled Secure Facility
• 24/7 Physical Security Monitoring
• 90-Day Video Surveillance & Retention
• Cabinet/Cage Perimeter Security
• Badge and Biometrics
• Compliance Base Audit Reports
• Security Incident Response Notification

Compliance is a shared responsibility. Your company must address, implement and manage all other technical and administrative controls outside of physical safeguards.

Federal Information Security Management Act (FISMA)

All government agencies, government contractors, and organizations that deal and exchange data with government systems must follow FISMA compliance guidelines. Organizations have to monitor, retain and maintain audit records of all security events as per FISMA.

The objective of FISMA compliance is to ensure that Federal departments and agencies observe measures to mitigate the security risks to critical data.

For federal agencies to use the services of a provider, the services must be based in a FISMA compliant data center that meets the stringent security requirements mandated by the Federal Information Security Management Act (FISMA). The National Institute of Standards and Technology (NIST) creates and maintains the specific security standards that agencies and their vendors are required to follow to remain compliant.

Agency compliance is ensured by the Office of Management and Budget (OMB), which each year reviews federal agencies’ IT programs to verify that they are FISMA compliant whether hosted on- or off-premise. The scope of the assessment included CyrusOne’s documented policies and procedures as well as controls implemented for its data centers. The controls that made up the assessment were awareness and training, incident response, maintenance, physical and environmental, personal security, and risk assessment.

SSAE Reports

SOC 1 (SSAE) Report

Statement on Standards for Attestation Engagements (SSAE) are attestation standards put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA). This report is intended to be relied upon by the financial statement auditors of CyrusOne customers. The SSAE assesses the physical security, environmental safeguards and network monitoring controls implemented by CyrusOne. Assessing these controls through the SSAE demonstrates CyrusOne’s commitment to the protection of all IT assets.

ISAE 3402 (SOC 1) are International Standards for Assurance Engagements, which is an assurance standard. The title is “Assurance Reports on Controls at a Service Organization”. It was published in June 2011 as a standard for documenting that a service organization has adequate internal controls; the approach is always from a financial reporting perspective.

SOC 2 (SSAE) Report

Attestation Standard 101 (AT 101) are attestation standards put forth by the ASB of the AICPA that assess CyrusOne’s controls against the Trust Services Principles and Criteria. The principles of Security and Availability are included in CyrusOne compliance reports.

SOC 2 (SSAE) Report reports in CyrusOne’s compliance suite include test results of disaster recovery and business continuity plans. The availability of these services is a critical success factor for enterprise customers.

Health Information Trust Alliance (HITRUST)

The Health Information Trust Alliance (HITRUST) Common Security Framework (CSF) is a comprehensive and certifiable security framework used by healthcare organizations and their business associates to efficiently approach regulatory compliance and risk management. HITRUST unifies recognized standards and regulatory requirements from NIST, HIPAA/HITECH, ISO 27001, PCI DSS, FTC, COBIT, and can be completed according to SOC 2 (SSAE) Report criteria, making it the most widely-adopted security framework in the U.S. healthcare industry.

CSA Security, Trust and Assurance Registry (CSA STAR)

CSA Security, Trust and Assurance Registry (CSA STAR) is the industry’s most powerful program for security assurance in the cloud. STAR encompasses key principles of transparency, rigorous auditing, harmonization of standards, with continuous monitoring also available in late 2015. STAR certification provides multiple benefits, including indications of best practices and validation of security posture of cloud offerings.

Federal Financial Institutions Examination Council(FFIEC)

Federal Financial Institutions Examination Council (FFIEC) is a formal U.S. government interagency body that includes five banking regulators—the Federal Reserve Board of Governors (FRB), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Consumer Financial Protection Bureau (CFPB). It is “empowered to prescribe uniform principles, standards, and report forms to promote uniformity in the supervision of financial institutions.” FFIEC Compliance is conformance to a set of standards for online banking which was issued in October 2005. In order to determine whether or not an institution is in compliance with FFIEC guidelines, comprehensive assessments of the internal environment must be conducted to identify potential security weaknesses and threats. Then goals must be set, solutions implemented and periodic risk assessments performed in order to maintain an adequate level of security.