Why your high-rise lease may deserve a seat at your HITRUST r2 scoping table
This post reflects the practitioner’s perspective on a scoping factor that reasonable people read differently. For authoritative guidance, consult HITRUST’s published scoping documentation and discuss your specific situation with your external assessor during readiness.
Author: Steve Meyer, CCSFP and CHQP
Here’s a scenario. You’re an IT compliance leader at a healthcare technology company. Your team occupies two floors of a Class A high-rise. You’re building your HITRUST r2 assessment object in MyCSF, working through scoping factors one by one, and you arrive at this one:
“Is the scoped system(s) (on-premises or cloud-based) accessible by third-party personnel (e.g., business partners, vendors, cloud providers)?”
Your instinct says “No. It feels like a confident no. Your team manages everything internally. Your cloud workloads run on infrastructure you control. You don’t give vendors remote access to your environment. There are no third-party administrators, no outsourced NOC, and no managed service provider with standing credentials.
But before you click “No”, consider who else has keys to your building?
This is one of the most deceptively simple scoping factors in the HITRUST r2 framework, and for organizations operating in leased commercial office space, it demands far more scrutiny than it typically receives. The answer you give here shapes your entire tailored control set, and getting it wrong in either direction creates real problems: unnecessary control burden if you answer “Yes” when you don’t need to, or an assessor finding if you answer “No” and can’t back it up.
Why Leased Office Environments Matter in HITRUST Scoping
As Clearwater assessors, we often see organizations focus heavily on logical access when thinking through HITRUST scoping, and understandably so. Most teams have spent years strengthening IAM controls, tightening VPN access, and improving privileged access management. But this particular scoping factor asks organizations to take a broader view of access.
At its core, the question is simple: can any non-employee third parties, including vendors, business partners, cloud providers, building management personnel, or others, potentially access systems that fall within your r2 assessment scope?
What makes this tricky is the word accessible. HITRUST is not asking whether those third parties actively use your systems every day. It is asking whether your technical architecture, contractual arrangements, or physical environment could enable that access.
That means access should be evaluated holistically, including:
- Logical access, such as remote connectivity, credentials, APIs, and support channels
- Physical access, including proximity to equipment, network cabling, shared infrastructure, or secured office spaces
In our experience, physical access is often where organizations uncover unexpected scoping considerations, especially in leased office environments. Many healthcare organizations operate in shared buildings, managed suites, or multi-tenant office spaces where parts of the physical environment are not entirely under their control.
That does not automatically create a compliance issue. But it does mean organizations should pause and thoughtfully evaluate how building management, maintenance personnel, shared facilities, or third-party providers could potentially interact with systems or infrastructure considered in scope for the assessment.
This is less about finding fault and more about making sure the scoping conversation reflects the realities of how modern organizations actually operate.
Why Leased Office Space Can Complicate HITRUST Scoping
If you operate in a leased commercial office, there is a cast of characters who may have physical access to your space, and who could, depending on your control environment, potentially interact with scoped systems. Let’s walk through them.
Building Management and Landlord Personnel
Property managers and building engineers typically retain master key or keycard access to all tenant spaces per the terms of the lease agreement. Many commercial leases include “right of entry” clauses that allow the landlord or its representatives to access your space for inspections, maintenance, emergencies, and even prospective tenant showings.
These personnel can physically enter your suite and often without advance notice in emergency scenarios, and sometimes with as little as 24 hours’ notice for non-emergency access, depending on your lease terms.
Janitorial and Cleaning Crews
Almost universally contracted by the building owner, not the tenant. These crews enter your space after hours, often unsupervised, with access to every room that isn’t independently locked.
They work around desks, workstations, server closets, and network equipment nightly. They empty trash cans next to your servers. They vacuum under your developers’ desks. They are in your space more consistently than many of your own employees.
HVAC, Electrical, and Plumbing Maintenance
Building systems maintenance personnel have access to mechanical rooms, electrical panels, and HVAC units that may be co-located with or adjacent to your network infrastructure.
In many high-rise environments, the IDF (intermediate distribution frame) or wiring closet shares space with building mechanical systems, sometimes literally in the same room. A building engineer troubleshooting an HVAC issue may be standing next to your core network switch.
Fire Safety and Inspection Personnel
Fire marshals, sprinkler technicians, and alarm monitoring companies have periodic and emergency access to all tenant spaces. Annual fire inspections require access to every room in your suite, including server rooms, data closets, and utility spaces.
Inspection frequency and scope vary by jurisdiction and occupancy classification; in many cases, inspections extend to server rooms and data closets and are not practically refusable.
Security Guards
Building security personnel patrol common areas and may have access to tenant floors. In some building configurations, building security manages the access control system for the entire property, including your suite’s card readers and door controllers.
If building security has administrative access to grant or revoke badge access to your space, that constitutes third-party control over your physical security perimeter.
Telecom and ISP Technicians
Internet service providers and telecom carriers may need access to wiring closets, demarc points, or patch panels, infrastructure that may sit within or immediately adjacent to your scoped environment.
When your ISP dispatches a technician to troubleshoot a circuit issue, that technician may end up in a room with your network equipment.
Pest Control Services
Quarterly or monthly pest control services access every area of the suite, including closets and utility spaces. They open every door, inspect every corner, and spray in every room, including the one with your network rack.
Recommendations
Whether you’re approaching this scoping factor for the first time or revisiting it for a reassessment, here’s what I’d recommend:
Walk your space with fresh eyes. Before answering this scoping factor, physically walk every room, closet, and shared space in your leased environment. Note every door that a non-employee could open. Check whether your server room lock is on the building master. Photograph the current state. You may be surprised by what you find. I’ve seen server rooms with no lock at all, wiring closets doubling as supply storage, and network switches sitting on open shelves in shared hallways.
Read your lease — carefully. The right-of-entry, maintenance, and common-area provisions in your commercial lease may surprise you. These clauses were negotiated by your real estate team, not your security team, and they often grant broader access than your compliance posture requires. If necessary, negotiate amendments or addenda that support your security requirements.
Talk to your assessor early. If you’re on the boundary between “Yes” and “No,” discuss it with your external assessor during readiness. A good assessor will tell you whether your compensating controls are sufficient to support a “No” answer or whether you should scope in the third-party access controls and plan accordingly. This conversation is far better to have during readiness than during validated testing.
Consult HITRUST’s own scoping guidance. HITRUST publishes guidance on scoping and tailoring. Blog posts and practitioner commentary (including this one) are interpretive; HITRUST’s own documentation and your assessor’s read are the authoritative sources.
Document your rationale. Regardless of whether you answer “Yes” or “No,” write it down. A brief scoping rationale memo that explains your analysis of third-party access in your leased environment, who has access to the building, what controls are in place, and why you reached your conclusion demonstrates rigor and gives your assessor confidence in your scoping decisions.
Don’t let the building be your blind spot. IT compliance teams focus on logical access, cloud architecture, and vendor management, and rightfully so. But the physical environment, especially a leased one you don’t fully control, is often the last thing evaluated and the first thing an assessor notices when they visit your office for testing. Make it part of your assessment preparation from day one.
Physical Access is a Vector to System Access
Why does physical access matter for a scoping factor that asks about system accessibility? Because physical presence in an uncontrolled environment is a path to system access. Here’s how that plays out in practice:
- An unattended workstation in a space accessible to janitorial staff is a system accessible by third-party personnel — unless you can demonstrate controls that prevent interaction. Enforced screen locks, locked offices, and clean desk policies are your defense here. Without them, a logged-in workstation with access to your scoped cloud environment is an open door.
- A server rack or network switch in a shared mechanical/electrical room is accessible to building maintenance — unless it’s in a separately locked cabinet or enclosure with access restricted exclusively to your personnel. An unlocked rack in a room that building engineers can enter is, from an assessor’s perspective, a system accessible by third parties.
- Network cabling that runs through building risers and shared conduit is physically accessible to telecom technicians and building engineers. While cable-layer attacks are not the most common threat vector, the HITRUST framework thinks in terms of risk surface, not probability.
- A wiring closet that doubles as a janitorial supply storage area — more common than anyone wants to admit — means cleaning crews have regular, unsupervised access to your network infrastructure. If the mop bucket lives next to your patch panel, you have a scoping problem.
The question isn’t whether these third parties intend to access your systems. It’s whether the environment permits it. Under a conservative reading of this factor, the relevant question isn’t whether third parties access your systems, but whether the environment reliably prevents them from being able to and whether you can demonstrate that prevention.
Key Insight
Many organizations assume this scoping factor only applies when third parties have direct logical access through credentials, remote connections, or APIs. But HITRUST often views access more broadly.
Even if outside parties do not have system credentials, their ability to physically access infrastructure, workstations, or network equipment may still be considered “access” depending on the controls you do (or do not) have in place. For organizations operating in leased office environments, this is a common and understandable reality that deserves thoughtful evaluation during HITRUST scoping.
CSF Domains and the Additional Requirements that get Triggered
- Domain 06 – Configuration Management
Ensures that any changes to the environment are documented, tested, and authorized to prevent security gaps.
- Domain 09 – Transmission Protection
- Domain 11 – Access Control
- Domain 14 – Third-Party Assurance
Note: The exact requirements tailored in or out are determined by MyCSF based on the full combination of scoping factors for your assessment. The domains above are those most commonly expanded when third-party access is in scope; the authoritative view of your tailored control set comes from MyCSF itself.
In practice, answering “Yes” can add a meaningful number of additional requirement statements to the assessment, each requiring evidence at the Implemented (Level 3) maturity or higher. For organizations with otherwise tight scoping, this single factor can meaningfully expand the total control burden.
However, and this is important, answering “Yes” when the honest answer is “Yes” protects you. A scoping answer that doesn’t match what an assessor can observe, whether through a facility walk, interviews, or evidence review, becomes a finding, and findings on scoping decisions tend to cast doubt on other scoping answers. Consistency between the scoping you declare and the environment you operate in is the foundation that the rest of the assessment rests on.
The question isn’t whether these third parties intend to access your systems. It’s whether the environment permits it. Under a conservative reading of this factor, the relevant question isn’t whether third parties access your systems, but whether the environment reliably prevents them from being able to and whether you can demonstrate that prevention.
Answering “No” doesn’t mean third parties can’t enter your office. It means you’ve implemented controls sufficient to ensure they cannot access scoped systems, and you can prove it to an assessor who is going to walk your halls, open your closet doors, and ask pointed questions.
