I recall reviewing an ASP that had a very robust business continuity plan that included having helicopters supply diesel for its generators if trucks could not get through. Yet, it ignored s serious physical security vulnerabilities. We drove around its parking lot three time and later learned that no one was watching the cameras. We pointed out that a four-wheel drive vehicle could easily drive up the steps to its front door, smash though it and into the lobby. If it keep going,the vehicle would break through the wall of the computer room. The local fire regulations required a floor plan of the site be posted in the building lobby which was open to anyone who walked through the front door. Snap a picture of the floor plan on your camera phone and you had a record of everything's location.

In general, I found that ASPs were quite weak on documentation. Ask them if they can show you evidence that they ever had security awareness training for their staff. It's very unlikely.

Personnel security is another weak area where again documentation is either not available or they will not share it.

While some aspects of ASP security can be tested as the author suggests, others are much harder to come by.