An environmental controls testing program focuses on the physical environment supporting IT infrastructure. This includes verifying the functionality of systems that protect against environmental threats. Key components are testing fire suppression systems (e.g., smoke detector tests, sprinkler system checks), ensuring power continuity through UPS and generator load tests, and confirming that HVAC systems maintain appropriate temperature and humidity levels, which is often verified through maintenance records and sensor logs. These tests ensure the physical safety and operational stability of data centers and other critical facilities.

A. These are components of a technical security or application security testing program, not an environmental one.

C. These are administrative and personnel security controls, focusing on people and processes rather than the physical environment.

D. These are logical and data-centric controls related to information security policy and incident response, not physical facility controls.

1. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire. Domain: N. Physical and Environmental Security, Section N.3: Environmental Controls. The SIG explicitly requests evidence of testing for fire detection/suppression, power, and climate control systems.

2. Certified Third Party Risk Professional (CTPRP) Body of Knowledge. Domain 4: Third Party Risk Assessment, Section 4.3: Control Domains. This section outlines physical and environmental controls as a key area for assessment, distinct from logical or administrative controls.