APPENDIX TO POLICY
To identify IT resources that must be in a data center and define data center security requirements to protect the IT resources located in a data center.
Systems to locate in a Data Center
The following table defines systems or applications that need to be located in a data center.
|ID||Type of System||High||Medium||Low|
Data Center Requirements
The following table defines requirements for a data center.
|DC.B.01||Disaster recovery plan in accordance with University Business Continuity policy (including who is responsible for DR plan for tenant hardware and data)||Required||Required||Required|
|DC.B.02||Limit access to the facility to only those with business need and prior approval||Required||Recommended||Recommended|
|DC.B.03||Identify and maintain a log of who has access to the facility||Required||Recommended||Recommended|
|DC.B.04||Secure servers and network equipment (i.e., lockable casings, lockable racks, secure consoles). Lock vacant data center rooms.||Required||Recommended||Recommended|
|DC.B.05||Document procedures for securing keys or door access to the facility||Required||Recommended||Recommended|
|DC.B.06||Change access codes when personnel change and at least annually||Required||Recommended||Recommended|
|DC.B.07||Periodically review who has key or card access to the facility (suggested: semi-annual or annual)||Required||Recommended||Recommended|
|DC.B.08||Monitor and log ingress/egress from facility (i.e., via staff, video, card access logs, etc.)||Required||Recommended||Recommended|
|DC.B.09||Protect against damage from physical emergencies (i.e., fire, flood, explosions, storms) and civil unrest (e.g., physical protections, fallback equipment and backup media at a safe distance from the facility)||Required||Recommended||Recommended|
|DC.B.10||Provide air conditioning, humidity controls, and fire detection / suppression systems to protect the facility and equipment in accordance with local fire safety regulations and manufacturers standards||Required||Recommended||Recommended|
|DC.B.11||Monitor for outages in cooling, electrical or water||Required||Recommended||Recommended|
|DC.B.12||Protect facility from failures of power and other necessary utilities||Required||Recommended||Recommended|
|DC.B.13||Establish stable and redundant power supply (Uninterruptible Power Supply) to maintain critical systems||Required||Recommended||Recommended|
|DC.B.14||Document procedures for the data center||Required||Required||Recommended|
|DC.B.15||Escort visitors, vendors, delivery staff, maintenance staff||Required||Recommended||Recommended|
|DC.B.16||Wear a visible form of identification that is University authorized (e.g., name badge issued by the University, government, or approved companies)||Required||Recommended||Recommended|
|DC.B.17||Document procedure and approvals needed for removing equipment or media from the facility||Required||Recommended||Recommended|
|DC.B.18||Document procedures for controlling maintenance and repair of equipment protecting systems in the facility||Required||Recommended||Recommended|
|DC.B.19||Use cameras to monitor areas in the facility. Audit collected data and correlate with who should have access.||Recommended1||Recommended||Recommended|
|DC.B.20||Use emergency lighting||Required||Recommended||Recommended|
|DC.B.21||Provide emergency power switches near emergency exits||Required||Recommended||Recommended|
|DC.B.22||Segregate equipment that requires unique environmental controls||Required||Recommended||Recommended|
|DC.B.23||Periodically test recovery procedures (i.e., power outage)||Required||Recommended||Recommended|
|DC.B.24||Do not store hazardous or combustible materials||Required||Recommended||Recommended|
|DC.B.25||Train staff on requirements related to working in or entry to a secure facility||Required||Recommended||Recommended|
|DC.B.26||Establish rules for eating, drinking, proper attire and other non-work related activities in the facility||Required||Recommended||Recommended|
1 This is required for systems in scope for credit card processing environment per PCI-DSS. This includes systems that support or store, process or transmit cardholder data.
This standard applies to IT resources owned or contracted by the University.
This standard applies to University community members who use or manage University IT resources.
More information on Data Center
- November 2014