Infrastructure Security
What is Infrastructure Security?
Security measures for protecting the core technology infrastructure including servers, networks, storage, and operating systems from threats.
Terms that appear alongside infrastructure security
Each of these is named in at least one of the same controls as infrastructure security. The number is how many controls name both.
- cloud infrastructure security 25 shared controls
- nist 9 shared controls
- iso 27017 5 shared controls
- network segmentation 5 shared controls
- serverless security 5 shared controls
- cloud workload protection 5 shared controls
- hardening 5 shared controls
- cloud configuration management 5 shared controls
Frameworks that govern infrastructure security
What the standards actually require on infrastructure security
Requirements naming infrastructure security across 6 standards, quoted from the control text.
Critical information infrastructure must be built with performance supporting stable and continuous operation and with security technical measures planned, constructed and put into use simultaneously (Article 35);
china-cybersecurity-law-csl::35-36 · Art. 35-36 Critical information infrastructure: security built in simultaneously, a specialised security body with vetted responsible persons, training and assessments, disaster recovery backups, emergency plans and drills →Security Layer 1 Infrastructure per X.805 Clause 7.1: The Infrastructure Security Layer consists of network facilities (transmission facilities and network elements) protected by the security measures.
X805-Layer1-Infrastructure-Security-Transmission-Facilities-Network-Elements-Lines-Routers-Switches · ITU-T X.805 Security Layer 1 - Infrastructure Security + Transmission Facilities + Network Elements + Routers + Switches + Lines + Physical + Datacenter + Optical + Radio Access + Wireless + Wireline + Edge →Cloud workload protection. Control from NIST SP 800-190 framework, domain: NIST SP 800-190: Cloud Infrastructure Security.
NIST190-18 · Cloud workload protection →34 CFR 99.31(a)(6)(iii)(D) safeguards requirement + the PTAC Best Practices Guidance + SPPO Guidance. The 2011 final rule explicitly requires APPROPRIATE METHODS to PROTECT PII when disclosed under the studies + audit + evaluation exceptions.
FERPA-Safeguards-PTAC · Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance) →Regulated companies formally assess every supplier of computerized systems and services used in GxP regulated work, including cloud service providers, external service providers and internal functions, with the approach based on critical thinking about what is...
gamp-5-good-automated-manufacturing-practice::M2 · Appendix M2 Supplier Assessment →The processes identified under 8.2 must include, as appropriate, controls over human resource management and over how security-related equipment, instrumentation and information technology are designed, installed, operated, refurbished and modified.
iso-28000-2022::8.4 · Controls →Questions people ask about infrastructure security
What is Infrastructure Security?
Why is Infrastructure Security important for compliance?
Which compliance frameworks address Infrastructure Security?
Where can I learn more about Infrastructure Security?
See how Infrastructure Security applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.