PR.IR-02 says the organization's technology assets are protected from environmental threats. That means fire, flooding, wind, extreme heat and humidity, and the loss of power or cooling. If you run a cloud first company, most of this is handled by your providers, and your job is to confirm it.
CSF is voluntary and there is no CSF certification.
What good looks like
Any equipment you own sits somewhere that is safe from known local hazards. Server closets are not under a water pipe. Anything you host elsewhere is covered by contract terms that mention environmental protection and adequate operating infrastructure, as NIST's examples suggest.
How to implement it
- Inventory the physical equipment you own: office servers, network gear, backup drives, laptops stored in bulk.
- Check each location for flood, fire, heat, and power risk. Add a smoke detector, a temperature alert, and a surge protected power supply where missing.
- For cloud and colocation providers, read their published assurance material and note which regions you use and how you spread across zones.
- Add environmental protection and infrastructure requirements to your supplier review for anything that runs systems on your behalf.
Why a cloud first company still cares
If everything you run lives in a major cloud, the provider handles the building, power, and cooling. You still own a few things. Your choice of region decides which natural hazards apply. Your choice to use a single zone decides whether a local power or cooling failure takes you down. And anything you keep on site, such as a small file server or a box of backup drives, is entirely your problem.
A simple site review
Walk through each location with a checklist of six questions. Is there water above or below the equipment? Is there smoke detection and a way to put out a small electrical fire? Is the room temperature monitored with an alert? Is the equipment on a surge protector or small battery backup? Is it off the floor in a flood prone area? Is it physically locked? Take photos, date them, and file them. Repeat once a year or after any move.
Asking providers the right questions
When you evaluate a hosting or colocation supplier, ask how they protect against fire, flood, and power loss, and ask for documentation rather than a verbal answer. NIST's examples suggest including protection from environmental threats in the requirements for service providers that run systems for you. A short clause in the contract or a note in your supplier file, pointing to the provider's published description of their facilities, is enough for a small company.
Evidence to collect
- A list of owned equipment with locations.
- A photo or checklist of the site review.
- Supplier documents that describe data center protections.
- Your region and zone choices for production.
Common gaps
Backups stored in the same room as the servers. A network closet that doubles as storage. No temperature alerting. Assuming the cloud provider covers everything without ever noting which provider documents you relied on.
Quick check
We only use cloud services. Does this outcome apply?
Yes, in a lighter form. You still choose regions and zones, hold any on site equipment, and should review what your providers say about facility protection.
Sources
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), PR.IR-02 and its implementation examples.
