8.2 Multi-Tenant Facility
All changes in this version
Title changed
Before · SP 800-116
Multi-Tenant Facility
After · SP 800-116 Rev. 1
Multi-Tenant Facility
Control changed
Before · SP 800-116
The challenge with a multi-tenant facility is to meet the security policies and requirements of the individual tenants in the facility. Some tenants may need higher security than others. The security policies may not be uniform and cannot be imposed upon others. In this situation, a collective (also known as the Building Security Committee) determination has to be made by the designated officials (representatives for each Federal tenant), the owning or leasing department or agency, and the security organization responsible for the facility to identify appropriate areas within the facility. In the end, the decision may be to implement the highest necessary security for the entire facility or to apply the lowest security to the facility while affording individual agencies additional security. If the highest security is implemented for the entire facility, there is one security perimeter and the security posture is no different from a single-tenant facility. Otherwise, the multi-tenant facility may be viewed as an outer and inner perimeter where different security can be implemented. The outer perimeter is the most common security measure that all the tenants agreed to and the inner perimeter is an agency-specific security measure. For example, the facility may designate Controlled area at the outer perimeter but one of the tenant agencies may require Exclusion area protection. Access to the building may be generally satisfied with a Controlled area authentication mechanism, but the individual agency should implement an Exclusion area authentication mechanism for access to its floor(s). In this example, the building is the outer perimeter while access to an individual floor is the inner perimeter. Since there are multiple tenants in the facility, it is strongly recommended that each individual tenant designate its own “Controlled, Limited, Exclusion” areas and employ appropriate FIPS 201 authentication mechanisms as in Figure 7-1. Since by definition the multi-tenant facility hosts Federal government employees and contractors, the outer perimeter can be PIV-enabled and individual agencies may piggyback on the authentication performed at the outer perimeter. Figure 8-2 is an example of a multi-tenant facility. The building lobby is the outer perimeter implementing PIV-enabled PACS, while the individual tenants implement additional security perimeters for stronger cardholder authentication.
LOBBY Tenant 1 Tenant 2 Tenant 2 Tenant 3
LOBBY Tenant 1 Tenant 2 Tenant 2 Tenant 3
Figure 8-2: Multi-Tenant Facility
After · SP 800-116 Rev. 1
The challenge with a multi-tenant facility is to meet the security policies and requirements of the individual tenants in the facility. Some tenants may need higher security than others. The security policies may not be uniform and cannot be imposed upon others. In this situation, a collective (also known as the Building Security Committee) determination has to be made by the designated officials (representatives for each Federal tenant), the owning or leasing department or agency, and the security organization responsible for the facility to identify appropriate areas within the facility. In the end, the decision may be to implement the highest necessary security for the entire facility or to apply the lowest security to the facility while affording individual agencies additional security. If the highest security is implemented for the entire facility, there is one security perimeter and the security posture is no different from a single-tenant facility. Otherwise, the multi-tenant facility may be viewed as an outer and inner perimeter where different security can be implemented. The outer perimeter is the most common security measure that all the tenants agreed to and the inner perimeter is an agency-specific security measure. For example, the facility may designate Controlled area at the outer perimeter but one of the tenant agencies may require Exclusion area protection. Access to the building may be generally satisfied with a Controlled area authentication mechanism, but the individual agency should implement an Exclusion area authentication mechanism for access to its floor(s). In this example, the building is the outer perimeter while access to an individual floor is the inner perimeter. Since there are multiple tenants in the facility, it is strongly recommended that each individual tenant designate its own “Controlled, Limited, Exclusion” areas and employ appropriate FIPS 201 authentication mechanisms as in Figure 7-1. Since by definition the multi-tenant facility hosts Federal government employees and contractors, the outer perimeter can be PIV-enabled and individual agencies may piggyback on the authentication performed at the outer perimeter. Figure 8-2 is an example of a multi-tenant facility. The building lobby is the outer perimeter implementing PIV-enabled PACS, while the individual tenants implement additional security perimeters for stronger cardholder authentication.
LOBBY Tenant 1 Tenant 2 Tenant 2 Tenant 3
LOBBY Tenant 1 Tenant 2 Tenant 2 Tenant 3
Figure 8-2: Multi-Tenant Facility