Fire Suppression

Since data centers face a significant risk of fire, they typically have sophisticated fire suppression systems. There are basically two types of systems: gas-based systems and water-based systems. The data center relies on more than just fire suppression systems, however, as controls. Other fire suppression controls include

  • Building construction

  • Fire extinguishers

  • Proper handling and storage of hazardous materials

19 Ensure that data center building construction incorporates appropriate fire suppression features.

For over 30 years, building codes have required that building be constructed in such a way as to resist fire. Some fire suppression features include

  • Fire-rated walls and doors to prevent fire from moving from one area of a building to another

  • Firestops where fire-rated walls or floor assemblies are sealed to prevent the spread of fire

  • Standpipe fire hose systems to provide a ready supply of water for fire suppression

The absence of these features introduces the risk of a fire spreading more quickly and causing additional damage and possibly threatening life.


In auditing fire suppression, the auditor should review the available fire suppression features built into the facility. The facility manager or local fire marshal should be able to provide information about wall/door fire rating and firestops. Standpipe water systems will be visible and observed easily during a building tour.

20 Ensure that data center personnel are trained in hazardous materials handling and storage and that hazmat procedures are appropriate.

Hazardous and highly flammable materials are a common cause of fire. These materials include

  • Diesel and other fuels

  • Solvents and thinners

  • Propane or acetylene torches

  • Chlorine or ammonia-based chemicals

  • Glues and bonding compounds

These materials should be handled and stored in a proper manner to mitigate the risk of fire or spillage.


Data center employees should be trained in and there should be procedures that ensure the proper handling and storage of hazardous materials. In auditing hazmat procedures and training, the auditor should review hazmat incident reports, training materials, and procedures, as well as interview data center staff.

21 Verify that fire extinguishers are placed every 50 ft within data center isles and are maintained properly.

Fire extinguishers are often the first line of fire defense. In data centers, they should be placed in hallways and aisles every 50 ft or so. There are three common types of extinguishers: dry chemical-based, water-based, and inert gas-based. In most cases, data centers should use inert gas-based fire extinguishers, such as CO2 because water and dry chemicals damage electrical equipment. A lack of usable fire extinguishers could result in a small fire getting out of control.


During the course of the data center audit, the auditor should review the locations of fire extinguishers, as well as a sample of the attached service tags. The data center facility manager also should be able to supply maintenance records.

22 Ensure that fire suppression systems are protecting the data center from fire.

All data centers should have a fire suppression system to help contain fires. There are two common types of systems: gas-based systems and water-based systems. Modern fire suppression systems most often are multistage, where the first sensor (usually a smoke sensor) activates the system, and a second sensor (usually a heat sensor) causes a discharge of either water or gas.

Gas-Based Systems There are several varieties of gas-based fire suppression systems, including CO2 FM-200, CEA-410, and others. Gas-based systems are more expensive and often impractical, but they do not damage electronic equipment in the same manner as water-based systems.

Water-Based Systems Water-based systems are less expensive and more common but can cause damage to computer equipment. To mitigate the risk of damaging all the computer equipment in a data center or in the extended area of a fire, fire suppression systems are designed to only drop water from sprinkler heads at the location of the fire. There are four common types of fire suppression systems:

  • Wet pipe. Pipes are always filled with water.

  • Dry pipe. Pipes are filled with air and are filled with water at the time of a discharge.

  • Preaction. Pipes are filled at stage 1 activation, and water is discharged during stage 2.

  • Deluge. A type of dry pipe system that discharges a large amount of water to overwhelm a fire.

The absence of a fire suppression system would allow a fire to spread more quickly, causing a greater degree of equipment loss and possibly loss of life.


When auditing fire suppression systems, the auditor should review system design, maintenance, and test records. This information can be obtained through a combination of interviews, document review, and observation. The data center facility manager should be able to provide the design, maintenance, and test documentation.

IT Auditing. Using Controls to Protect Information Assets
It Auditing: Using Controls to Protect Information Assets [IT AUDITING -OS N/D]
Year: 2004
Pages: 159 © 2008-2017.
If you may any questions please contact us: