Data Center Review Audit Work Program

DATA CENTER REVIEW AUDIT WORK PROGRAM:
SAMPLE 1
PROJECT TEAM (LIST MEMBERS)
Project Phase Date Comments
Planning
Fieldwork
Report Issuance
AUDIT OBJECTIVES
Objective Comments Initial
Evaluate access controls for the data center.
Evaluate environmental controls for the data center.
Develop recommendations to create meaningful change.
OVERVIEW
Audit Step Initial Index
Document the location and physical characteristics of the facilities that

comprise the data center, tape library and offsite data storage
environments.
PHYSICAL SECURITY
Review written procedures to ensure that they document the personnel

authorized to access secure areas and that controls are in place to
prevent unauthorized access to the data center.
Ensure that vendor service personnel and visitors are supervised while in
the data center.
Determine if access to the data center is restricted by using keys, cipher

locks, badges or other automated security devices.
• If access is controlled through an automated system, determine if
procedures for granting and revoking access and reviewing and
retaining logs are adequate. Determine if a process is in place to
review access logs for failed access attempts (e.g., out of permitted
2 Source: www.knowledgeleader.com
hours, etc.).
• If keys or cipher locks are used, review the adequacy of procedures for
distribution, custody, retrieval and periodic reissuance.
Obtain a list of individuals with access to the data center and test for
reasonableness.
Ensure that all mechanical and telecommunication rooms/closets are

adequately secured to prevent tampering.
Determine if access to server terminals is restricted both physically and

logically (e.g., cabinets are locked, and terminal requires logging in to
use).
ENVIRONMENTAL
Audit Steps Initial Index
Ensure that clear and adequate fire placards are posted in strategic
locations and that fire alarm pull boxes and emergency power switches
are visible and unobstructed.
Determine if automatic fire/water detection/extinguishing systems are

present. If so, perform the following:
• Review the results of recent system tests performed.
• Ensure that the system is periodically tested and protected by a
backup power supply.
• Review logs of preventative maintenance activities for
appropriateness.
Ensure that fire evacuation procedures are posted in the data center.
Ensure that portable fire extinguishers within the data center have been
inspected/recharged within the last 12 months.
Determine if adequate air conditioning and humidity control systems are

present. If so, perform the following:
• Ensure that ventilation and air conditioning systems are adequate to
maintain appropriate temperature and humidity levels.
• Ensure that temperature and humidity levels are recorded and
routinely monitored.
• Ensure that the system is periodically tested and protected by a
backup power supply.
appropriateness.
Determine if adequate backup power supply systems are present. If so,

perform the following:

appropriateness.
Review the physical environment of the data center for the following:
• Quality housekeeping occurs (e.g., clean, clutter-free, lack of
flammable materials, etc.).
• Wiring and patch panels are organized in a clean and manageable
fashion.
REPORTING
Use a standard template to create the internal audit report (including a

compilation of findings resulting from the work performed).
Hold a closing meeting with key management to review the internal audit
report draft and findings.
Publish the final report.
DATA CENTER REVIEW AUDIT WORK PROGRAM:
SAMPLE 2
Project Timing Date Comments
Planning
Fieldwork
Report Issuance (Local)
Report Issuance (Worldwide)
AUDIT OBJECTIVE
Determine that information resources are protected against unauthorized access and environmental hazards.
Time Project Work Step Initial Index
Control Objective A: Physical Security
Procedures: Verify that the security architecture and security

administration procedures for the data center properly prevent
unauthorized access by performing the following steps:
• Review written procedures to ensure that they document the personnel

authorized to access secure areas. Ensure that controls are in place to
prevent unauthorized access to the data center.
• Verify that vendor service personnel and visitors are supervised while
in the data center through discussion.
• Determine if access to the data center is restricted by using keys,
cipher locks, badges or other automated security devices.
• If access is controlled through an automated system, determine if
procedures for granting and revoking access and reviewing and
retaining logs are adequate. Determine if a process is in place to
review access logs for failed access attempts (e.g., out of permitted
hours, etc.).
• Obtain a data center key card system report listing personnel with
active badge access to the data center room and compare the names
on the report to the names and titles in the current employee list. For
the (Insert Company) employees listed on the data center list, verify
that only current employees have access to the data center.
• Verify that personnel listed on the data center access list have a valid
business reason for accessing the data center. Valid business reasons
for accessing the data center room include performing technical
support, security administration, change management, backup, and
recovery or other job responsibilities that require direct access to the IT
hardware; company management responsible for operations of the
division; building management or security personnel that require
access for fire code reasons; or maintains other equipment located in
Time Project Work Step Initial Index
the data center room.

• Verify that each person on the data center access list is assigned a
unique key card to ensure accountability for accessing the data center.
• Determine if access to server terminals is restricted both physically and
logically (i.e., cabinets are locked and terminals require logon to use).
Control Objective B: Environmental Security
Procedures: Determine if adequate physical security measures are in

place to properly protect the data center environment by performing the
following steps:
• Ensure that clear and adequate fire placards are posted in strategic
locations and that fire alarm pull boxes and emergency power switches
are visible and unobstructed.
• Ensure that emergency lighting is available in the data center.
• Ensure that there are raised floors, or all equipment is raised at least X
inches off the floor.
• Determine if automatic fire/water detection/extinguishing systems are
present.
• Determine if adequate air conditioning and humidity control systems
are present. If so, verify the following:
− Is the air conditioning unit dedicated?
− Are ventilation and air conditioning systems adequate to maintain
appropriate temperature and humidity levels?
− Are temperature and humidity levels recorded and routinely
monitored?
• Determine if uninterruptible power supply (UPS) systems are present.
If so, perform the following:
− Determine how long the UPS runs.
− Determine the switch over/failover plan to a generator.
• Determine if network cables and sockets are labeled.
• Determine if IS is notified if monitoring systems (for air conditioning,
UPS system, etc.) are triggered.
• Determine if preventive maintenance is performed on data center
equipment (i.e., UPS system, fire suppression, air conditioners, smoke
detectors, etc.).
• Review the physical environment of the data center for the following:
− Quality housekeeping (i.e., clean, clutter-free, lack of flammable
materials, etc.) occurs.
− Wiring and patch panels are organized in a clean and manageable
fashion.

Data Center Review Audit Work Program

Uploaded by

Copyright:

Available Formats

Data Center Review Audit Work Program

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Data Center Review Audit Work Program

Uploaded by

Copyright:

Available Formats

DATA CENTER REVIEW AUDIT WORK PROGRAM:

PROJECT TEAM (LIST MEMBERS)

Project Phase Date Comments

Objective Comments Initial

Evaluate access controls for the data center.

Evaluate environmental controls for the data center.

Develop recommendations to create meaningful change.

Audit Step Initial Index

Document the location and physical characteristics of the facilities that

Audit Step Initial Index

Review written procedures to ensure that they document the personnel

Determine if access to the data center is restricted by using keys, cipher

Ensure that all mechanical and telecommunication rooms/closets are

Determine if access to server terminals is restricted both physically and

Audit Steps Initial Index

Determine if automatic fire/water detection/extinguishing systems are

Determine if adequate air conditioning and humidity control systems are

Determine if adequate backup power supply systems are present. If so,

• Review the results of recent system tests performed.

Audit Steps Initial Index

Use a standard template to create the internal audit report (including a

Publish the final report.

Project Timing Date Comments

Report Issuance (Local)

Report Issuance (Worldwide)

Time Project Work Step Initial Index

Control Objective A: Physical Security

Procedures: Verify that the security architecture and security

• Review written procedures to ensure that they document the personnel

the data center room.

Control Objective B: Environmental Security

Procedures: Determine if adequate physical security measures are in

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.