ICT assets, physically
Comms rooms, data rooms, on-premise infrastructure and the buildings around them are part of ICT risk management. They are not a separate facilities concern with its own conventions.
DORA · Financial entities & their ICT suppliers
Third-party access became a regulatory question
DORA requires physical and environmental protection of ICT assets, and extends that requirement to the third parties who work on them. Supplier access moved from a facilities question to a board-level report.
DORA
DORA and physical access to ICT assets
What it demands of physical access
Physical and environmental protection of ICT assets, extended to the third parties who work on them.
Physical and environmental protection of ICT assets, extended to the third parties who work on them.
What you put in front of the auditor
Contractor access to data halls, time-bound, approved by a named owner and closed on exit.
Contractor access to data halls, time-bound, approved by a named owner and closed on exit.
In detail
What this means at the door
The third-party register has a physical dimension
You maintain a register of ICT third-party arrangements. The natural follow-up question. Which of them can physically reach the systems, has to be answerable by supplier and by contract, without trawling individual badge records.
Reviews on a cycle, evidenced
Access reviews are expected to be performed, evidenced and repeatable on demand. That means a scheduled process with recorded confirmations, instead of an exercise assembled each time a supervisor asks.
Closed on exit
Access that outlives the contract is the finding that repeats. Where the end date lives on the contract and the record together, the closure stops depending on anyone remembering.
How Axxession answers it
Evidence produced as it happens
- Access anchored to the contracting company and its contract. Supplier-level reporting is a filter
- Recurring reviews owned by the person responsible for each room, with the confirmation recorded
- Unconfirmed access expiring by default, instead of quietly staying open
- The review record, approvals and reasons exporting as the submission itself
Sectors
Where DORA bites hardest
Axxession gives you the records DORA asks for, ready to show an auditor. Compliance itself also rests on your own policies, risk assessment and controls. Nothing here is legal advice.
Questions
Frequently asked questions
Does DORA apply to physical access?
DORA's ICT risk-management requirements include physical and environmental protection of ICT assets. Its third-party provisions extend the governance to providers who work on those assets. Physical access to comms rooms and data rooms therefore sits inside the ICT risk framework, and not beside it.
How do we report which ICT suppliers can physically reach our systems?
By holding access against the contracting company and its contract as well as the individual. The report is then produced by filtering on supplier, with the approvals and review confirmations attached, without investigating badge records.
What does an evidenced access review look like?
The owner of each zone re-confirms who should still hold access, on a defined cycle. The confirmation and reason are recorded against each grant, and access nobody re-confirms expires. The evidence then comes out of the process itself, and never out of a project.
The first step
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay