Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

Iron Mountain Uses a Single Assessor

for Agile Expansion of Data Center Compliance

  • Services: SOC 2, FISMA, ISO 27001, PCI-DSS Validation
  • Using Schellman as its sole provider, Iron Mountain was able to satisfy a diverse group of compliance needs and requests across multiple domains in an expedited timeframe.

Over 156,000 organizations in the corporate and public sectors depend on Iron Mountain to protect what matters most.

Iron Mountain stores and protects billions of customer information assets – everything from medical records and business documents to some of the world’s most valuable historical and cultural artifacts. As a result, secure and compliant business practices are extremely important. When Iron Mountain expanded its data center colocation business, it was critical to establish a partnership with a first-rate auditing firm to codify Iron Mountain’s ability to maintain and exceed industry standard compliance requirements for customers in highly regulated industries. 

  • Services: SOC 2, FISMA, ISO 27001, PCI-DSS Validation
  • Using Schellman as its sole provider, Iron Mountain was able to satisfy a diverse group of compliance needs and requests across multiple domains in an expedited timeframe.
computer-code-on-screen

With the exponential growth of consumption-based/cloud services, the corresponding risks have skyrocketed, disrupting IT departments globally. Highly regulated organizations require third-party service providers to maintain FISMA-compliant infrastructure while balancing efficient, agile, and cost-effective IT. The rapid rate of technology change also affects the ability to forecast future demand and commit capital to long-term projects.

So, what are highly regulated organizations doing to solve the challenge? They are going big–finding global brands they know and trust, who feature comprehensive compliance portfolios that satisfy specific regulatory needs.

After 30 years of providing wholesale data center management services to enterprise customers, Iron Mountain found itself fielding multiple requests from existing customers for a secure data center colocation solution that would meet the needs of highly regulated industries. While Iron Mountain is well known for storage and information management, third-party assessment would help validate the company’s expansion into the data center colocation space. By leveraging Schellman’s single assessor advantage, Iron Mountain’s data center team quickly and effectively completed the certifications and attestations that their highly regulated customer base required.

computer-code-on-screen
Quote
“Offering secure and compliant data center services means doing more than checking boxes. You have to fully understand what it entails from the customer’s perspective and be able to offer a service that helps them mitigate risk.”

Chris Bair | Iron Mountain Vice President of Sales and Marketing

earth-lights-from-space

It was clear that to serve banks, hospitals, and federal agencies, Iron Mountain needed to extend existing compliance certifications and attestations into the data center line of business. The company needed a partner who was familiar with data center best practices to effectively align new controls with FISMA, ISO 27001 and PCI. Schellman’s extensive experience in the data center space was pivotal to the company’s selection.

After thorough market research and numerous pre-sales engagements, Iron Mountain Data Centers selected Schellman to perform three separate audits. Iron Mountain Data Center executives cited numerous determining factors including Schellman’s status as a CPA firm with a globally licensed PCI Qualified Security Assessor, an ISO Certification Body and a FedRAMP 3PAO. This unique combination allowed Iron Mountain Data Centers to obtain FISMA, ISO, and PCI-DSS compliance from a single firm, creating a set of common controls to use across all three assessments.

“Schellman understood our business model right away,” said Jennifer Bertelli, Iron Mountain Data Centers’ Compliance Manager. “The collaborative discussion on controls and industry best practices put us on the fast track to capturing the compliance standards demanded by our enterprise customer base in an expedited time frame.”

earth-lights-from-space
Quote
“The efficiencies gained from working with a single assessor like Schellman cannot be understated. From an internal resources perspective, it was a lot easier to work with one auditor who understood our business and could verify our compliance against several standards versus working with three different auditors and explaining our business three different times. We also considered the implementation. There were quite a few shared control requirements across FISMA, ISO, and PCIDSS. Schellman & Company executives quickly identified the common controls, isolated the nuances, then gathered the supporting data and applied it to all three audits.”

Jennifer Bertelli | Iron Mountain | Compliance Manager

Schellman Services

Iron Mountain Data Centers initially worked with Schellman to obtain a NIST attestation to assist their federal customers with FISMA efforts. Soon after followed additional projects, including an ISO 27001 certification and PCI-DSS validation. 

FISMA Compliance

In order for federal government and other public sector agencies to deploy with a third-party data center provider such as Iron Mountain Data Center’s, the desired facilities must meet the same underlying NIST SP 800-53 requirements as would an in-house facility under FISMA regulations. Schellman assessed the Iron Mountain Data Centers Information Security Management System (ISMS) and related processes and controls across all Iron Mountain data centers. This involved on-site and remote research; identifying and mapping the necessary in-scope FISMA requirements, and travelling to the data centers and corporate headquarters to observe and inspect all in-scope controls.

Quote
"Thanks to the full cooperation and engagement of the entire Iron Mountain Data Centers team, Schellman was able to make assessments quickly and formulate an appropriate compliance roadmap. Initial assessment to report issuance can take other firms months to execute. Schellman accomplished this with Iron Mountain in a few weeks, properly addressing the client’s speed-to-compliance business challenge."
Doug Barbin

Doug Barbin | Schellman Principal and Security Services Leader

ISO Certification

Pursuing an ISO 27001 certification was a key objective because Iron Mountain supports an international customer base and ISO’s ISMS management framework is internationally recognized as the “gold standard.” “By successfully completing the ISO 27001 audit, Iron Mountain has demonstrated a mature security system to prospective and existing  customers that conduct businesses both domestically and internationally,” explained Doug Barbin, Schellman Principal and Security Services leader. “ISO certifies Iron Mountain’s ability to successfully self-monitor, assess risks, respond to threats, and adapt to unexpected changes.”

Schellman completed the entire ISO 27001 audit from initial assessment to formal certification in five months. The two-stage process included on-site assessments at Iron Mountain Data Centers and its corporate headquarters, collaborative review of their ISMS policies and procedures, and testing of Iron Mountain Data Centers controls.

Quote
"By successfully completing the ISO 27001 audit, Iron Mountain has demonstrated a mature security system to prospective and existing customers that conduct businesses both domestically and internationally. ISO certifies Iron Mountain’s ability to successfully self-monitor, assess risks, respond to threats, and adapt to unexpected changes."
Doug Barbin

Doug Barbin | Schellman Principal and Security Services Leader

PCI Validation

Financial service organizations, hosted payment gateways, and other organizations that handle, store, or transmit sensitive data such as credit card and social security numbers or other Personally Identifiable Information (PII) are subject to PCI-DSS regulations. As with FISMA and ISO, PCI-DSS provides detailed requirements for internal and third-party services provider controls.

Quote
"While there were common controls across each of the Iron Mountain Data Centers compliance engagements with Schellman, PCI-DSS presented some unique requirements than can often lead to long validation turn times. Thankfully, Iron Mountain had been through PCI with its core document business. Leveraging existing security practices and its dedicated compliance resources helped Schellman complete the assessment within one month."
Doug Barbin

Doug Barbin | Schellman Principal and Security Services Leader

Iron Mountain Data Centers Reduced Time-to-Compliance with Schellman's Single Assessor Advantage

Quote
“When Iron Mountain selected Schellman for three major compliance engagements, they reaped the benefits of our single assessor advantage,” continued Barbin. “When preparing for multiple audits for a single client, Schellman is able to prioritize activity according to intensity of requirements, ensuring maximum common control carryover. In addition to common controls, choosing three different auditors would have led to three different sets of Iron Mountain Data Center’s business research, stakeholder interviews, and other onboarding activity conducted by each auditor.”
Quote
“At Iron Mountain, we provide enterprise data center services for some of the most highly regulated organizations in the world,” said Chris Bair, Vice President of Sales and Marketing. “Delivering a comprehensive compliance offering is both a market differentiator and service commitment that instills confidence in every Iron Mountain Data Centers customer. With so much on the line, enterprise and public-sector IT executives can place critical IT infrastructure in our data centers with confidence knowing our global brand will protect what matters most to their business.”
Quote
“From day one, the auditing Iron Mountain desired was not an entry-level, ‘check-thebox” type engagement,” said Barbin. “Usually data center providers start with a SOC report and ease up from there as cost and time commitments can become prohibitive. Iron Mountain started with three highly complex assessments, which I believe demonstrates real commitment and support to their Fortune 2000 and public-sector customers who face intense, ever-changing industry regulations on a daily basis.”

Jane Doe | CEO, box

Quote
“Our goal from day one was to earn Iron Mountain’s trust by demonstrating expertise, professionalism, and a dedication to addressing a key project priority: leveraging existing operational excellence to reduce time-to-compliance,” said Barbin, “and in doing so, we proved to be an ideal partner.”

Connect with a Schellman specialist.

We are a trusted provider to the world’s leading companies with a service delivery model which allows for optimum quality and client experience for organizations of every size and complexity.