SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT

Transcription

1 THE TELX GROUP SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT Report On Telx s Interconnection And Colocation Services Relevant To Security And Availability For the Period April 1, 2014 March 31, 2015 Company, product or service names may be trademarks or service marks of others. Telx Interconnection and Data Centers 1 State Street, 21st Floor, New York, NY P TELX v.0215

2 SERVICE ORGANIZATION CONTROLS 3 REPORT TABLE OF CONTENTS REPORT OF INDEPENDENT ACCOUNTANTS 3 MANAGEMENT S ASSERTION 4 DESCRIPTION OF TELX S INTERCONNECTION AND COLOCATION SERVICES SYSTEM 5 Company, product or service names may be trademarks or service marks of others. Telx Interconnection and Data Centers 1 State Street, 21st Floor, New York, NY P TELX 2

3 REPORT OF INDEPENDENT ACCOUNTANT To the Management of The Telx Group: We have examined management s assertion that The Telx Group ( Telx ) during the period April 1, 2014, through March 31, 2015, maintained effective controls over the Interconnection and Colocation services (described in the attached system/service description) to provide reasonable assurance that: the system as defined, was protected against unauthorized access (both physical and logical); and the system as defined, was available for operation and use as committed or agreed; based on the criteria for the security and availability principles set forth in the AICPA s TSP Section 100, Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy. This assertion is the responsibility of Telx s management. Our responsibility is to express an opinion on management s assertion based on our examination. Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included (1) obtaining an understanding of Telx s relevant system security and availability controls; (2) testing and evaluating the operating effectiveness of the controls; and (3) performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion. Because of inherent limitations in controls, errors or fraud may occur and not be detected. Furthermore, the projection of any conclusions, based on our findings, to future periods is subject to the risk that the validity of such conclusions may be altered because of changes made to the system or controls, the failure to make needed changes to the system or controls, or deterioration in the degree of effectiveness of the controls. In our opinion, Telx s management s assertion referred to above is fairly stated, in all material respects, based on the Trust Services Security and Availability Criteria. Weaver and Tidwell, L.L.P. Dallas, Texas June 15, 2015 Page 3 of 7

4 MANAGEMENT S ASSERTION REGARDING THE EFFECTIVENESS OF ITS CONTROLS OVER TELX S INTERCONNECTION AND COLOCATION SERVICES SYSTEM BASED ON THE TRUST SERVICES PRINCIPLES AND CRITERIA FOR SECURITY AND AVAILABILITY Telx provides its Interconnection and Colocation services as described in the attached system/services description. The Management of Telx maintained effective controls over the security and availability of its Interconnection and Colocation services system to provide reasonable assurance that: the system was protected against unauthorized access (both physical and logical); and the system was available for operation and use as committed and agreed; during the period April 1, 2014 through March 31, 2015, based on the criteria for the security and availability principles set forth in the AICPA s TSP Section 100, Trust Services Principles and Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy. Our Description of The Telx Group s (Telx s) Interconnection and Colocation Services System summarizes those aspects of the system covered by our assertion. Subservice providers are utilized in the fulfillment of Interconnection and Colocation services. Control activities performed by subservice providers were included within the scope of this examination. Page 4 of 7

5 DESCRIPTION OF TELX S INTERCONNECTION AND COLOCATION SERVICES OVERVIEW OF TELX S OPERATIONS Telx facilities provide customers with a reliable, secure and climate controlled environment to house their networking and computing equipment and facilitate interconnections. Telx colocation products consist of customized space options, redundant power and cooling systems, physical security, fire suppression and water leak detection systems. Space Telx provides colocation space for a recurring monthly fee for a cabinet or on a per square foot basis for cage space. Telx customers that license cage spaces typically begin at 100 square feet in an interconnection and colocation facility, and often license such space in multiple interconnection and colocation facilities. Customers sign service orders, governed by the terms and conditions of a master services agreement, with a typical term of one to five years. Power Telx's facilities feature customizable and redundant power, full UPS power and generator backup to deliver the highest level of uptime availability for its customer's mission critical operations. Telx offers both Alternating Current (AC) and Direct Current (DC) power configuration options; Customers can procure custom power solutions based on their deployment specifications. AC Power - Available in 110v, 208v and 208v 3-Phase from 15-amps on up. DC Power - 48v DC power is available from 10-amps on up. Cooling Temperature and humidity controls are carefully maintained through Telx s HVAC systems. The following are present in Telx Colocation and Interconnection Facilities: Generator backup power supplies Building security Climate controlled air conditioned space Fire protection systems Superior infrastructure Multiple links to the Internet Rooftop access Network-neutral Environment Customers within Telx s facilities have access to hundreds of other customers (depending on the facility) such as telecommunication carriers, cloud and content providers and other enterprises, allowing customers many connectivity options to physically connect to one another and exchange data without incurring local loop fees. Flexibility Another benefit of colocation is an increase in operational flexibility, customers enabled to grow and deploy new technology as their needs change without having to make substantial facility investments. Furthermore, Telx builds each colocation cage to suit the needs of each customer requirements, allowing customers greater flexibility and control. Interconnection Products Telx cross connect products enable our customers to connect directly to a wide variety of communications service providers, enterprise or other customers. These products are typically provided for a recurring monthly fee per connection. Page 5 of 7

6 Our Internet Exchange product enables customers to establish public or private peering with other members of the Exchange on a fully manage intermediary switch device. Telx interconnection products are predominantly direct connections via passive cross connects, however, Telx also managed connectivity services for the convenience of our customers. Managed connectivity services include Metro Connect, DIA, TIE, Ethernet Connect, Carrier Connect and AWS Direct Connect. The Telx suites of interconnection products are outlined below: Product Cross Connect and Packs Riser Fiber IntraCustomer Connectivity Telx Internet Exchange (TIE) Dedicated Internet Access (DIA) Metro Cross Connect Description Physically connects customer networks within our facilities. Physically connects customers between a Telx suite and a non-telx suite. Physically connect non-contiguous customer spaces in a Telx facility. Facilitates the exchange of IP traffic between service providers through a peering platform. Telx s Dedicated Internet Access ( DIA ) service provides customers with a dedicated Internet connection suitable for any business need. Services are offered as DIA Standard or DIA Premium and are available with multiple configuration options designed to meet the needs of your organization. Provides ability to interconnect between two Telx facilities in the same metro area, enabling seamless connectivity between customers within these facilities. Product Ethernet Connect AWS Connect Carrier Connect Description The Telx Ethernet Connect platform is an open marketplace where multiple providers can connect, share traffic and interconnect services over a highly resilient, carrier grade Ethernet switching platform. Leveraging the Amazon Web Services AWS Direct Connect service Telx customers can now connect directly to Amazon Web Services via a single cross connect from the Telx data center facility. Telx Carrier Connect is a privately-owned and managed platform, providing translation and TDM muxing capabilities for connected customers BOUNDARIES OF INTERCONNECTION AND COLOCATION SERVICES The boundaries of a system are the specific aspects of a service organization s infrastructure, software, people, procedures, and data necessary to provide the relevant services. The system refers to the system of internal controls as it relates to the defined scope, Telx s Interconnection and Colocation Services. The term system is used throughout the report as reference to the Interconnection and Colocation Services, unless otherwise specified as an actual software application. The boundaries of Telx s system include infrastructure and software components that directly support the Interconnection and Colocation Services provided to Telx s customers. Any infrastructure and software that indirectly support the services provided to Telx s customers are not included within the boundaries of Telx s system. For purposes of this report, customers or user entity refers to any organization using Telx s Interconnection and Colocation Services. Page 6 of 7

7 Other services which may be provided by Telx are not addressed within the scope of this report. The scope and objectives described in the report are specific to the following 20 locations: Atlanta 56 Marietta Street, Atlanta, Georgia (ATL1) Charlotte 113 North Meyers Street, Charlotte, North Carolina (CHR1) Chicago 350 East Cermak, Chicago, Illinois (CHI1) 600 South Federal, Chicago, Illinois (CHI2) Dallas 2323 Bryan Street, Dallas, Texas (DAL1) 8435 North Stemmons Freeway, Dallas Texas (DAL2) Los Angeles 600 West 7th Street, Los Angeles, California (LOS1) Miami 36 North East 2nd Street, Miami, Florida (MIA1) New Jersey 300 Boulevard East, Weehawken, New Jersey (NRJ1) 100 Delawanna Avenue #1, Clifton, New Jersey (NJR2) 100 Delawanna Avenue #2, Clifton, New Jersey (NJR3) New York City 60 Hudson Street, New York, New York (NYC1) 111 Eighth Avenue, New York, New York (NYC2) 32 Avenue of the Americas, New York, New York (NYC3) Oregon 3825 Northwest Aloclek Place, Hillsboro, Oregon (PRT1) Phoenix 120 East Van Buren Street, Phoenix, Arizona (PHX1) San Francisco 200 Paul Avenue, San Francisco, California (SFR1) Santa Clara 1100 Space Park Drive, Santa Clara, California (SCL1) 2820 Northwestern Parkway, Santa Clara, California (SCL2) Seattle 3433 South 120 th Place, Tukwila, Washington (SEA1) Telx provides Interconnection and Colocation Services to using multiple telecom service providers for backbone connectivity and multiple colocation management providers for data center facility management. Specifically, Digital Realty Trust, L.P. (Digital Realty), Vantage Data Centers (Vantage) and Rudin Management Company, Inc. (Rudin) are noted as subservice organizations, which provide Facility Management Services in certain Telx facilities included within the scope of this report. Other than those specified, Weaver s examination did not extend to controls of other providers. The alignment of Telx and subservice organizations internal controls to specific criteria necessary to fulfill the security and availability Trust Services Principles is included in Section IV of this report. For purposes of this report, Telx provides Interconnection and Colocation Services, as described in Sections III and IV, from the aforementioned locations. SERVER MAINTENANCE AND DATA Interconnection and Colocation Services do not include maintenance of the servers (such as updating the servers with the latest patches) nor do standard Interconnection and Colocation Services include server backup and recovery. Telx does not maintain responsibility for the data customers store on their servers; the data is the responsibility of the customer. These items are the responsibility of the user entity. Page 7 of 7