Title

Environmental IA Controls - Fire Detection and Suppression (Cat III impact)

Discussion

Failure to provide adequate fire detection and suppression could result in the loss of or damage to data, equipment, facilities, or personnel. REFERENCES: 32 CFR 117 and 32 CFR 2001 and 2003 as well as DOD Manual 5220.32 Volume 1 NIST Special Publication 800-53 (SP 800-53), Rev 4, Controls: PE-13 and PE-13(1), (2), (3) and (4) NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook NIST SP 800-100, Information Security Handbook: A Guide for Managers

Check Content

1. Check to ensure a fully automatic fire detection and suppression system is installed for information system areas that automatically activates when it detects heat, smoke, or particles. 2. Check that a servicing fire department receives an automatic notification of any activation of the smoke detection or fire suppression system. 3. Check for periodic fire detection and suppression test logs. 4. Check the fire detection and suppression system(s) are supported by an independent or alternate (backup) energy source. NOTES: This check applies primarily to facilities containing concentrations of information system resources including, for example, data centers, server rooms, and mainframe computer rooms. Fire suppression and detection devices/systems include, for example, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors.

Fix Text

An adequate fire detection and suppression system must be installed and must be periodically tested. The following considerations must be incorporated into the system: 1. A fully automatic fire detection and suppression system must be installed for information system areas that automatically activates when it detects heat, smoke, or particles. 2. A servicing fire department must receive an automatic notification of any activation of the smoke detection or fire suppression system. 3. Periodic testing of the fire detection and suppression system must be conducted. 4. The fire detection and suppression system(s) must be supported by an independent or alternate (backup) energy source.

Additional Identifiers

Rule ID: SV-245753r1138420_rule

Vulnerability ID: V-245753

Group Title: EC-08.03.01

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.