Physical Validation: When to Perform Onsite

Question 1

Physical Validation:
When to Perform an Onsite

Answer 1

-Vendors with Data Centers or Co-Lo
-Vendors with large amounts of sensitive paper data
-Vendors where physical security is high risk concern

Question 2

Physical Validation:
When to Perform an Onsite
-Vendors with Data Centers or Co-Lo

Answer 2

-Vendors data centers are not well run generally.
-Data centers are expensive and get more expensive overtime due to maintenance.

-Co-Lo a mix between vendor data center and CSP.
-Look up exquanex
-You rent an area in these facilities and you build out
your data center there.

Question 3

Physical Validation:
When to Perform an Onsite
-Vendors with Large Amounts of Sensitive Paper Data

Answer 3

-Large amounts of physical or paper data.
-Physically checking the security is important.
-Law firms and health care still collect a lot of data.

Question 4

Physical Validation:
When to Perform an Onsite
-Vendors where Physical Security is Higher Risk Concern

Answer 4

-Drop ceiling can be pushed up and the room accessed.

-Look for clean desk, no papers and locked computers.

Question 5

So long and thanks for all the fish…Third party quits because doesn’t want to move forward with the physical validation activity

Answer 5

Soft skills, it’s not uncommon for the vendor to just not want to do an onsite visit.

-They’re at the point that they don’t want to do business with us anymore because of the onsite.
-See if they’ll do the virtual onsite then see if they’ll
do an observation onsite where you look at key
controls.

Engage your legal team to see if there is a legal reason for the physical validation.
-Talk to the business lines about the option to use another vendor.
-If the vendor is irreplaceable, then negotiate a way to get something done
-Half a sandwich and negotiate a pull physical validation in the next year or so.

Question 6

Physical Validation: Offshore

Answer 6

Who?
When?
Where?
What?

Offhore is relative to your general location.

Question 7

Physical Validation: Offshore
Who?

Answer 7

Who is your bucket requires a physical validation for off shore?
-Call centers
-Data processers, etc.

Question 8

Physical Validation: Offshore
When?

Answer 8

When?
During business hours
-Be aware of local customs and timing.
-There’s a certain time of the year that if I go to a country that not much is getting done because it’s a big holiday.

Question 9

Physical Validation: Offshore
Where?

Answer 9

Where?
-Facilities where employees are engaging with data and/or customers

Where are you going?
-Call center, off shore delivery center, data center.
-Understand the most important area for you to go to

Question 10

Physical Validation: Offshore
What?

Answer 10

What?
Review clean room policies and security controls (physical and logical)