Data centre and hosting operators: a C5 report your customers can work with

This page is for operators of data centres and hosting services who offer infrastructure as a service (IaaS), colocation or both, and whose customers ask them for a C5 attestation. How a SaaS provider separates its own subject matter of the audit from a data centre is shown on the C5 scope page; this page takes the operator’s perspective. You rent space in a data centre yourself and want to know which physical security criteria then remain with you? That is covered in the PS domain.

Why your report matters to your customers

If a cloud service is provided in data centres operated by third parties, section 3.4.6 says it is generally to be assumed that the operator is a subservice organisation of the cloud service provider. This applies to colocation as much as to IaaS: the supplementary information on PS-01 names server housing, colocation and IaaS as examples of premises operated by third parties. Your customers therefore have to describe in their documentation which controls they expect at your organisation, the complementary subservice organisation controls (CSOC), and how they monitor them (PS-01.05B and .06B with reference to SSO-05). For a colocation customer, hardware, operations and the granting of access rights to its own staff remain with the customer. A customer that excludes the data centre operations under the carve-out method nevertheless remains responsible. The supplementary information on SSO-06 names operating from data centres of service organisations as a case of very high dependency.

The more precisely your report describes the controls your customers expect, the easier this monitoring is for them. If these controls are missing, your customers can only include you in their own audit (inclusive method) or carry out their own audits at your premises.

The example: two locations, IaaS and colocation

Fictitious example, not a customer. An operator has two data centre locations in the same region in Germany. It offers:

• IaaS: virtual machines, networks and storage that customers set up themselves through a self-service portal and an API.
• Colocation: rented server racks with power, cooling and network connection; customers bring their own hardware and have access to their racks.
• Backup as an optional add-on service for IaaS customers.

Its customers include SaaS providers from the healthcare sector that are aiming for a C5 attestation themselves.

Decision 1: What belongs in the report: IaaS, colocation or both

The catalogue defines a cloud service as an information technology service offered via cloud computing (the German version 1.1.0 also refers to defined interfaces), and cloud computing as network access to a scalable and elastic pool of shared resources with self-service provisioning (section 1.2). The IaaS offering in the example meets this. Pure colocation, where customers rent racks and run their own hardware, does not in our view. The BSI FAQ supports this: if something is not itself a cloud service, no C5 audit of it is possible.

Even so, colocation customers rely on the same buildings, the same power supply and the same access control. Our recommendation: include IaaS in the report as the cloud service and describe the physical security of both locations in full, including the areas where colocation racks stand. Because the catalogue names colocation and IaaS alike as premises operated by third parties, your customers need the same kind of information in both models. Whether a colocation customer can use your report for its monitoring depends on whether the controls it expects are described and audited in it. Clarify this with your auditor when you define the scope.

One consequence concerns access: colocation customers send their own staff into your buildings. Among other things, PS-04.01B requires multi-factor authentication for access to areas hosting system components that process customer data, the revocation of access authorisations that have not been used for two months, and measures that identify and track visitors and external personnel individually (no. 2, 4 and 7). For customer staff with permanent access, this means authorisations that are revoked after two months without use, and exceptions only through the defined exception process.

Decision 2: Locations, zones and region in the report

The catalogue distinguishes terms that should be kept apart in contracts and in the report. A location is a single premises with its own power supply, network connectivity and fire protection, exclusive to a single zone. A region comprises one or more zones within a single metropolitan area. Your customers need this information because they themselves have to commit to processing data and backups only in the agreed region (PSS-12.01B).

PS-02.01B requires the service to be provided from at least two locations at an adequate distance from each other for operational redundancy, PS-02.03B a test of the redundancy at least annually. The additional criterion PS-02.01AS requires more than two locations with georedundancy, so that a third location remains available if two locations fail at the same time. The operator in the example works with two locations in one region for the basic criterion; it does not include the additional criterion and justifies the selection in the system description (section 3.4.3). For PS-02, the catalogue names as a complementary customer criterion that customers check the provider’s redundancy model against their own availability requirements. Describe the model, therefore, so that a customer can carry out this check.

Decision 3: Supply, additional criteria and emergency power tests

In a data centre, the physical criteria are at the centre. Three points should be decided before the audit:

1. Baseline supply. Among other things, PS-06.01B requires operational redundancy (N+1) in power and cooling supply, appropriately sized uninterruptible power supplies (UPS) and emergency power supplies whose functionality is tested at least annually (cf. BCM-04), and maintenance in line with the manufacturer’s recommendations. PS-06.03B requires the protection of power supply and telecommunications lines to be checked by qualified personnel at least every two years.
2. Additional criteria for self-sufficient operation. Among other things, PS-01.01AC to .05AC require time constraints for self-sufficient operation, at least 72 hours in the event of a failure of the external power supply or until all services are transferred to another location (PS-01.02AC), and a cooling supply designed for at least five consecutive days with the highest outside temperatures to be expected. According to the supplementary information, the 72 hours align with guidelines of the Federal Office for Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe, BBK). Whether you include these additional criteria is your decision; for customers with a higher protection need, the catalogue presents additional criteria as a starting point (section 3.4.3).
3. Tests with customers. BCM-04.01B requires affected cloud service customers and relevant third parties to be involved in the tests of the business continuity plans. A load test of the emergency power supply affects all customers at a location. The additional criterion BCM-04.02AC requires customers to be informed in good time about planned tests that could affect them, with the time frame and a description of the work, and BCM-04.03AC an assessment of the potential impacts. How continuity tests in general become auditable is covered in the BCM domain.

Decision 4: Who backs up the data?

For IaaS, the supplementary information on OPS-06 says that responsibility for backup and recovery of cloud service customer data “often remains with the customer”; backup is then not part of the contractual agreements. In this case the criterion does not apply to customer data, but it does apply to the operator’s data; the system description sets out to what extent it is applicable. In the example, backup is an optional add-on service. In our view it belongs in the report if it is offered, and the system description should state clearly that customers without this service back up their data themselves. This duty is then one of the complementary customer controls (CUEC).

Evidence operators should prepare

Possible gaps at data centre and hosting operators