Effective Data Centre control and management requires the development and ongoing maintenance of a diverse suite of integrated policies and processes.
The complexity and scope is often under estimated, resulting in lack of control and potential increased risk. Links to external best practices and regulatory requirements (ITIL, Information Security, Health & Safety) are also often ignored or not considered. Data Centre documentation is essential to:
- Support activity planning (Capacity and Configuration Management
- Manage growth / time to market (Change Management, Release and Deployment Management)
- Reduce error rates (Commissioning procedures, Quality Assurance, Checklists)
- Conform to Regulatory and Compliance requirements (SOZ, Health & Safety)
- Maintain Security Levels (Information Security, Access Management)
- Risk Reduction
- Operational activities (Event Monitoring, Incident Management, Request Management, Infrastructure Support)
- Knowledge Management (CMDB, Knowledgebase)
- Simplify access to information (online information and forms)
- Communication of effectiveness measures (CSFs, KPIs and Management Reporting)
This document highlights some of the key processes and procedures that might be considered when developing the web of Data Centre control documents.
Policy documents are top level ‘umbrella’ documents (see Figure 1) providing guiding principles relating to Data Centres / Computer Equipment Rooms - CPRs.
Policy definition:
- A written statement, approved by the management board, stating the organization’s official position
-
An organization wide set of rules governing operational procedures and activities, security patches etc.
-
A statement of principles and / or values
- An aid to setting organizational direction and decisions
- A high level summary of related processes and procedures
Key Data Centre Policies might include:
Access principles are critical for the maintenance of Data Centre Security. Access considerations should be considered at multiple levels e.g. building, suite, cabinet.
- Permanent vs. temporary access controls
- Access reasons
- Associated requirements (approved Change or Incident ticket / activity
- Access times (may be restricted to known access windows
- Third party access management
- Emergency access
- Exceptions to policy
A comprehensive set of rules relating to commissioning, change and decommissioning. Content might include:
- Asset / Configuration management, unique numbering, labelling
- Production vs. non production considerations
- Cabinet access and installation windows
- Cabling (approved mediums, management arms and channels, cable routes, containment, fastenings, layering etc.)
- Monitoring requirements (access, power, heat, humidity, connections etc.)
- Connections to power, LAN, SAN etc.
Health & Safety Policy
Clearly linked to external Health & Safety regulations and requirements. The policy (associated with lower level procedures) covers a number of wide ranging considerations including:
- Cleanliness
- Vermin control
- Data Centre signage
- Fire regulations
The Data Centre Code of Conduct
The Data Centre Code of Conduct should be a one page set of rules for all persons entering the Data Centre to abide by.
The regulations contained are included for the safeguard of the Data Centre and equipment items and asset contained and also for the well being of any employee entering the facility.
It is recommended that the Code of Conduct is displayed both outside and inside the Data Centre suite. Some organisations require that any person entering the Data Centre acknowledge and sign they have read and conform to the content prior to entering the facility.
Some key documents include:
ITIL Related / linked Procedures
Potentially a suite of procedures as there are multiple links to ITIL best practice functions and processes. Key associations include:
- Change Management
- Release and Deployment Management
- Asset and Configuraton Management (CMDB)
- Event Management
- Incident Management
- Problem Management
- Capacity Management
- Availability Management
- IT Service Continuity Management
- Continual Service Improvement
Information Security / Access Procedures
As previously mentioned, Security procedures need to be considered at multiple levels (perimeter, Data Suite and Cabinet level). Procedures might include:
- Physical security (security guards, access systems and passes, access recording and monitoring)
- Access. Detailed procedures / processes to be undertaken by personnel and security functions e.g. to request, grant access to a Data Centre or installed assets
- Cabinet access (keypad, remote opening)
- Monitoring (
- Security Incident management (links to Incident and Security teams and response processes)
- Confidentiality, Integrity, Availability of systems and contained data and information
Technical Procedures
A suite of procedures relating to the operation of technologies within the Data Centre. Significant items might include:
- IT systems operating procedures
- Structured cabling systems
- Environmental monitoring systems (power, temperature, humidity etc.)
- Physical Access Control Systems (card swipe, keypads, remote access)
- Cameras (IP, CCTV)
- BMS (mechanical and electrical monitoring and management)
Other Documents
In addition to the already large number of requirements highlighted above, there are some other documents types that might be considered.
Checklists
Alongside Procedures, it is often extremely valuable to develop Checklists. These aid Operational personnel to undertake procedures and activities in a consistent / repetitive manner. Examples include:
- Commissioning checklists e.g. server installation, pre go-live error checking
- Post installation quality Assurance checklists (was the server installed in the correct cabinet, position, cabled correctly, asset labelled etc.)
- Periodic audit checking and associated checklist (used as part of a regular walk around etc.)
Work Instructions
Similar to procedures. Often used when a third party vendor or supplier is involved.
For example, if a Remote Hands service is provided by a supplier, detailed Work Instructions might be developed to ensure consistency of approach to individual Remote Hands tasks.
In Summary
To develop and implement a full suite of Data Centre policies and procedures takes a significant investment in and time and resource.
The individual(s) responsible for the delivery of the above requires a number of skills:
- Negotiation skills – deployment requires a significant amount of workshop management and discussion to gain acceptance at all levels
- Communication skills – both written and verbal
- Presentation skills – to present content in an appropriate format for the target audience
- Industry / Best Practice knowledge – Data Centre, Mechanical and Electrical, ITIL, Information Security, Health and Safety, Risk Management etc.
- Technology awareness – procedures will cover nearly all major infrastructure elements including networks, storage, servers etc.
- Project Management skills – the author will often work on multiple procedures simultaneously so requires excellent tracking skills
For further information, please email This e-mail address is being protected from spambots. You need JavaScript enabled to view it
