Q:

Are there alternate processing and/or storage sites that can sustain operational continuity in case of an outage of the primary site?

Do the alternate processing and/or storage sites provide information security measures equivalent to the primary site?

Are alternate processing and/or storage sites separate from their primary site so they are not susceptible to the same hazards?

Have you identified potential accessibility problems to the alternate processing and/or storage site in the event of an area-wide disruption or disaster and outlined explicit mitigation actions?

Do you ensure equipment and supplies required to resume operations are available at the alternate site or contracts are in place to support delivery to the site in time?

A:

Q:

Do you track, control, authorize, and monitor information system components entering and exiting the facilities and maintain records for those items?

A:

Q:

Do you have documented physical security policy and procedures?

Do you have a process that restricts and maintains access to information facilities (data centers, computer rooms, computer/network labs, and telecommunication closets), and areas with Federal Reserve information to authorized personnel only?

Are access lists and authorization credentials reviewed at least annually?

Do you authenticate visitors before allowing access to facilities that are not designated as public access?

Do you have controlled entry points that use physical access devices and/or guards to facilities?

Do you change facility keys and combinations upon the lost, compromise, or individual transfer or termination?

Do you monitor physical access to facilities with real-time physical intrusion alarms and surveillance equipment?

Are visitors to the facilities logged, escorted and their activities monitored?

Do the facilities provide emergency power shutoff with switches or devices in locations where concentrations of information systems exists?

Do the facilities incorporate an uninterruptible and alternate power supply to protect against a short-term and long-term loss of primary power source?

Do the facilities have fire detection and fire suppression devices that activate automatically and notify emergency responders in the event of a fire?

Do the facilities employ automated mechanisms to monitor and maintain temperature and humidity level?

Do the facilities protect the information systems from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly and known to key personnel?

Do you have formal procedures to ensure access privileges are reviewed on a periodic basis?

Describe the logical and physical security of your hosting facility.

A: