INF.2 Data Centre and Server Room

Adequate technical and organisational requirements MUST be defined and implemented for a data centre.

When planning a data centre or choosing suitable rooms, appropriate security safeguards MUST also be planned that take the protection needs of the IT components (especially regarding their availability) into account.

A data centre as a whole MUST be designed as a closed security area. In addition, it MUST have different security zones. For example, administration, logistics, and IT operations and support areas MUST be clearly separated from each other. In the case of a server room, it SHOULD be checked whether it is possible to implement different security zones.

Suitable fire and smoke zones MUST be defined for the rooms of a data centre. The fire and smoke zones MUST also provide protection that goes beyond the scope prescribed by building law for the technical equipment located therein and its availability. Fire and smoke MUST be prevented from spreading. In the case of a server room, it SHOULD be checked whether adequate fire and zones can be implemented.

An uninterruptible power supply (UPS) MUST be installed for all the operationally relevant components of a data centre. As the power consumption of air conditioning is often too high for a UPS, the control of these systems MUST at least be connected to the UPS. In the case of a server room, the necessity of operating a UPS SHOULD be checked based on the availability requirements of the IT systems at hand.

The UPS MUST have sufficient capacity. If there are relevant changes in loads, checks MUST be carried out to establish whether the capacity of the existing UPS systems is still sufficient.

In UPS systems that use a battery for energy storage, the battery MUST be kept within the required temperature range. For this purpose, it SHOULD be kept away from the power electronics of the UPS if possible. The UPS MUST be serviced and checked for functionality at regular intervals. The maintenance schedule specified by the manufacturer MUST be followed for this purpose.

There MUST be suitable options for switching off the electrical consumers in a data centre. Attention MUST be paid to whether and how an existing UPS is spatially and functionally integrated into the power supply. If conventional emergency stop switches are used, it MUST be ensured that the entire data centre will not be switched off. The emergency shutdown system MUST be subdivided in a systematic and sensible manner. All emergency off switches MUST be protected such that they cannot be activated unintentionally or without authorisation.

It MUST be ensured that the air temperature and humidity in an IT operating area will remain within the prescribed limits. The actual thermal load in cooled areas MUST be checked at regular intervals and after major conversions.

Any air conditioning systems in use MUST be maintained regularly. At minimum, temperature and humidity parameters MUST be recorded in a way that makes it possible to retrospectively identify whether thresholds have been exceeded as a means of both pinpointing and eliminating the cause of any deviation.

Access to a data centre MUST be controlled. Site access rights MUST be assigned in accordance with the specifications of module ORP.4 Identity and Access Management. It MUST be ensured that those who work at a data centre do not have access to IT systems outside their scope of work.

All the possible ways to access a data centre MUST be equipped with site access control devices. Each instance in which a person accesses a data centre MUST be individually recorded by a site access control system. In the case of a server room, it SHOULD be checked whether it is appropriate to monitor all the possible ways to access the site in question.

Regular checks MUST be carried out to determine whether the regulations regarding the use of site access controls are being observed.

An organisation's requirements regarding its site access control system MUST be documented in a concept with a sufficient level of detail.

All the doors of a data centre MUST always be kept locked. Windows MUST be avoided in the planning stage whenever possible. If there are windows, they MUST always be kept locked. Doors and windows MUST provide protection adequate for the security level at hand against attacks and external influences. They MUST have privacy screens. Consideration MUST be given to the structural design of all room-forming elements and their ability to provide a uniform level of protection.

A fire alarm system MUST be installed in a data centre. It MUST monitor all areas. All the alarms of the fire alarm system MUST be forwarded appropriately (see also INF.2.A13 Planning and Installation of Alarm Systems). The fire alarm system MUST be serviced at regular intervals. It MUST be ensured that no particular fire loads are present in the rooms of a data centre.

An extinguishing or fire prevention system in line with the current state of the art MUST be installed in a data centre. If this is not possible, technical (especially a wide-area early detection system; see INF.2.A17 Early Fire Detection) and organisational measures (trained personnel and response plans for early fire detection alarms) MUST ensure that early fire detection alarms are responded to immediately and within no more than three minutes.

In server rooms without an extinguishing or fire prevention system, hand-held fire extinguishers with suitable extinguishing agents MUST be available in sufficient number and size. Attention MUST be paid to the fact that these provisions do not affect any additional building code requirements regarding the provision of hand-held fire extinguishers. The fire extinguishers MUST be mounted so that they are easy to access in case of a fire. Each fire extinguisher must be inspected and serviced regularly. All staff who are allowed to enter a data centre or server room MUST be instructed in the use of hand-held fire extinguishers.

For all components of building services infrastructure, the intervals and requirements for inspection and maintenance recommended by the respective manufacturers or specified by corresponding standards MUST be observed at minimum. Inspections and maintenance work MUST be documented. Firestop seals MUST be checked to ensure that they are intact. The results MUST be documented.

All infrastructure facilities, including leakage monitoring, air conditioning, and power and UPS systems, MUST be automatically monitored. Detected disruptions MUST be reported and dealt with in an appropriate manner as quickly as possible.

In the case of a server room, IT and support devices that do not or only occasionally need to be operated by a person SHOULD be equipped with a remote means of indicating malfunctions. The responsible employees MUST be alerted promptly.

A data centre MUST be equipped with an early fire detection system. A server room SHOULD be equipped with an early fire detection system. Early fire detection alarms MUST be routed to a continuously staffed department that can initiate a corresponding check and a protective response within three minutes. Alternatively, an automatic protective response MUST be initiated. In order to achieve a balance between fire protection and availability, it MUST be ensured that equipment providing redundancy is not located together within the effective range of the same voltage isolation circuit.

The cables laid in a data centre MUST be restricted to those that directly supply the technology installed there (usually IT and, if applicable, cooling technology). If structural reasons make it unavoidable to run lines through a data centre in order to supply areas other than those within the data centre, this MUST be documented along with suitable justification. The risks posed by such lines MUST be minimised by appropriate safeguards (e.g. enclosures and monitoring).

The aforementioned lines may be routed through server rooms without justifying why this is unavoidable, but they MUST be treated in the same way as described for data centres.

Messages from systems that monitor such lines MUST be checked and evaluated immediately to determine whether a threat is present. Countermeasures MUST be implemented in a timely manner according to the threat level identified (see also INF.2.A13 Planning and Installation of Alarm Systems).

Perimeter protection SHOULD be in place for data centres. Depending on the protection needs defined for a given data centre and its premises, perimeter protection SHOULD consist of the following components:

• A wall or fence around the property
• Security safeguards against accidental trespassing (crossing the property line)
• Security safeguards against deliberate trespassing without the use of force
• Security safeguards against deliberate trespassing through the use of force
• Outdoor security safeguards
• Visual detection of people and vehicles
• Safeguards for preserving evidence (e.g. video recording)
• Automatic alerts

The corresponding building's security concept SHOULD be used to plan which alarm systems are needed and should be installed for specific areas of a data centre. In addition, a procedure for dealing with alarm messages SHOULD be defined. The security concept SHOULD always be adapted if and when the use of the building's areas changes.

An alarm system that is fit for purpose SHOULD be installed. The notifications from the alarm system SHOULD be transmitted to an alarm receiving centre in compliance with the applicable technical connection requirements. The selected alarm receiving centre MUST be reachable at all times. It MUST be able to react appropriately to alarms in terms of its technology and personnel. The transmission path between the alarm system and the alarm receiving centre SHOULD be designed according to the technical connection requirements at hand and, if possible, with redundancy. All established transmission routes MUST be tested at regular intervals.

The power supplied to a data centre from the grid of an energy utility company SHOULD be supplemented by an emergency power system (EPS). If an EPS is in place, it MUST be regularly maintained. Load and functional tests, as well as test runs under load, MUST be conducted when performing maintenance.

The operating supplies for an EPS MUST be checked regularly to see if they are sufficient. Regular checks MUST also be performed to ensure that these supplies are still usable, and especially to avoid "diesel bug". If possible, low-sulphur heating oil SHOULD be used instead of diesel fuel. Refuelling operations MUST be logged. The log MUST include the type of fuel, the additives used, the date of refuelling, and the quantity refuelled.

If an EPS is not used for a server room, a UPS with a run time appropriate for the protection needs at hand SHOULD be implemented as an alternative.

A lightning and overvoltage protection concept SHOULD be drawn up on the basis of the currently valid standard (DIN EN 62305 parts 1 to 4). The lightning protection zones (LPZ) required for the proper operation of a data centre must be defined. For all the facilities required for the proper operation of a data centre and its ability to provide services, this SHOULD be at least LPZ 2. All overvoltage protection equipment SHOULD be subject to a comprehensive test once a year in accordance with DIN EN 62305-3 (table E.2).

It SHOULD be ensured that suitable climatic conditions are established and maintained in a data centre. A data centre's air-conditioning system SHOULD have sufficient capacity. All the relevant values SHOULD be constantly monitored. If a value deviates from the norm, an automatic alarm SHOULD be triggered.

Air-conditioning systems SHOULD be as fail-safe as possible in areas of IT operations.

The technical infrastructure of a data centre SHOULD be tested regularly (at least once or twice a year) and following system modifications and extensive repairs. The results SHOULD be documented. In particular, entire reaction chains SHOULD be subjected to a real function test.

A data centre SHOULD be equipped with an automatic extinguishing or fire prevention system.

A geographically separate alternate data centre SHOULD be established. The alternate data centre SHOULD have sufficient capacity to maintain all of the corresponding organisation’s processes. It SHOULD always be ready for operation, as well. All of the organisation’s data SHOULD be mirrored to the alternate data centre on a regular basis. The procedure for switching to the emergency data centre SHOULD be tested and drilled regularly. The transmission routes to the alternate data centre SHOULD be suitably secured and designed with appropriate redundancy.

During construction work in a data centre, suitable dust-protection measures SHOULD be defined, planned, and implemented. Persons who are not involved in the construction work themselves SHOULD check the dust-protection measures frequently to make sure they are working properly and the regulations on dust protection are being followed.

Cable routes in data centres SHOULD be carefully planned and implemented. Cable trays in data centres SHOULD be carefully designed in terms of their arrangement and dimensioning so that separation of voltage levels and a sensible distribution of cables on the trays is possible, and that sufficient space is also available for future increases in demand. To ensure the optimal supply of IT hardware that has two power supply units, a two-line A-B supply SHOULD be set up from the low-voltage main distributor for the IT operating areas in question. Pairs of redundant lines SHOULD be laid in separate trays.

Site access control and intrusion detection systems SHOULD be supplemented by video monitoring systems. A video monitoring system SHOULD be integrated into the overall security concept at hand. The Data Protection Officer MUST always be involved in the planning, design, and potential evaluation of video recordings.

The central technical components required for a video monitoring system SHOULD be installed in a suitable environment and protected. The video monitoring system SHOULD be tested regularly to ensure its proper function and its compliance with the angles of view agreed with the Data Protection Officer.

UPS systems SHOULD be modular and designed to have a redundant module compensate for any failure without interruption. If a two-line A-B supply is set up for IT operating areas, each of the two current paths SHOULD be equipped with an independent UPS system.

Emergency power systems SHOULD be redundant. With regard to maintenance, a redundant EPS MUST also be treated according to INF.2.A14 Use of an Emergency Power System.

For areas of data centres with increased protection needs, VdS class-C alarm systems SHOULD be used exclusively (in line with VdS Guideline 2311).