Alarm Systems

Data centers normally have several different alarm systems that are designed to monitor for unauthorized access to the facility, fire, water, and excessively high or low humidity. These alarm systems typically feed into a console located in the data center operations center.

14 Ensure that a burglar alarm is protecting the data center from physical intrusion.

A burglar alarm failure would allow a physical intrusion to go undetected. Burglar alarms mitigate this risk.

How

Burglar alarms are designed to detect physical intrusions. They do this through a series of sensors that are placed in strategic locations such as doors and hallways. Burglar alarm systems employ the following common types of sensors:

• Motion sensors that typically detect infrared motion

• Contact sensors that are placed on windows and doors to detect when they are opened

• Audio sensors to detect breaking glass or changes in normal ambient noise

When auditing a data center, the auditor should review sensor placement, verify that critical areas of the data center are covered adequately, and review maintenance logs to ensure that the system has been maintained and tested properly.

15 Verify that a fire alarm is protecting the data center from the risk of fire.

Because of all the electrical equipment, data centers are prone to fires. Fire alarms alert data center personnel of a developing fire condition so that they can evacuate the premise. A fire alarm failure would put human life at risk.

How

Data centers should have fire alarms to detect electrical fires before they can threaten human life. Data center fire alarm systems usually are multizone systems, which reduces the risk of false alarms due to a single malfunctioning sensor or zone. In a multizone system, sensors in two or more zones must detect the fire before an alarm sounds. There are three types of sensors:

• Heat sensors activate when temperature reaches a predetermined threshold or when temperatures rise quickly.

• Smoke sensors activate when they detect smoke.

• Flame sensors activate when they sense the infrared energy or flickering of a flame.

Smoke actuated sensors and heat sensors are most common. When auditing a data center, the auditor should review fire alarm sensor type, placement, maintenance records, and testing procedures.

16 Ensure that a water alarm system is configured to detect water in high-risk areas of the data center.

Water and electronic equipment do not mix well. As a result, data centers normally employ water sensors in strategic locations such as near water sources or under raised floors. Water sensors detect the presence of water and are designed to alert data personnel prior to a major problem.

How

When performing a data center audit, the auditor should identify potential water sources such as drains, air-conditioning units, exterior doors, and water pipes to verify that water sensors are placed in locations where they will mitigate the most risk. The facility manager should be able to point out both water sources and sensors during a tour of the facility. The auditor also should review maintenance records to ensure that the alarm system is maintained periodically.

17 Ensure that a humidity alarm is configured to notify data center personnel of either high or low-humidity conditions.

Humidity levels above 60 percent or below 40 percent can cause computer equipment damage. High humidity can cause corrosion of computer components, and low humidity can cause static electricity discharges that can short-circuit system boards. As a result, data centers should be equipped with humidity alarm systems.

How

In a proper humidity alarm installation, humidity sensors are placed in all areas of the data center where electronic equipment is present. When reviewing the humidity alarm system, the auditor should ensure that sensors are placed in appropriate locations either by reviewing architecture diagrams or by touring the facility. The auditor also should review maintenance and testing documentation to verify that the system is in good working order.

18 Review the alarm monitoring console(s) and alarm reports to verify that alarms are monitored continually by data center personnel.

Alarm systems most often feed into a monitoring console that gives data center personnel the opportunity to respond to an alarm condition before calling authorities, evacuating the building, or shutting down equipment. The absence of a monitoring console would introduce the risk of an alarm condition going unnoticed.

How

The data center should have an alarm-monitoring console, where alarm systems are monitored by data center personnel. The auditor should review alarm reports and observe the data center alarm-monitoring console to verify that burglar, fire, water, humidity, and other alarm systems are monitored continually by data center personnel. Occasionally, the burglar alarm is monitored by data center security staff. The main objective here is to verify that alarms are being monitored.

There also should also be procedures that data center personnel adhere to for handling each alarm condition. See "Data Center Operations" section below for more information on auditing procedures.