data center review audit program

8/4/2019 Data Center Review Audit Program

1/5

STANFORD UNIVERSITY

INTERNAL AUDIT PROGRAM

DATA CENTER REVIEW

DATA CENTER REVIEW PROGRAM

Our objectives are to ensure:

The physical security and access control measures are adequate toprevent unauthorized access to computer center areas.

The environmental controls are adequate to minimize hardware /software losses from fire or flood.

PROCEDURE RESPONSEW/P

REF.

I PRELIMINARY PROCEDURES:

A. Obtain a current list of personnel,(including positions), responsiblefor maintaining the programs,backing up the system/data files,and using the computer centersystems.

B. Obtain a schedule or document anoverview of the InformationSystems Including hardwareresources, software,support/design staff, and users) inthe Computer Center

Determine the overallcriticalness of each majorsystem identified

On dial-in lines does thesecurity system includecallback features or some othermeans of control to ensureauthorized access?

C. Review the previous audit reportand note items to be followed upduring the current audit.Determine if management hastaken appropriate and timelyaction to address the deficienciesnoted in the audit report.

D. Review any examination reportsreceived since the last audit.Determine if management hastaken appropriate and timelyaction to address the deficienciesnoted.

II PHYSICAL SECURITY

A. Determine the geographicallocation of the Data Center and


2/5

STANFORD UNIVERSITY


DATA CENTER REVIEW


REF.

evaluate the overall risks.

B. Identify any additional hardwarestorage locations (e.g. Servers,Gateways, Bridges, Routers,Multiplexors etc) and evaluate theirphysical security. (e.g.

Telecommunication Rooms,Electrical Switchgear Rooms).

(what other locations connect tothis facility?)

C. Assure that there are writtenprocedures in effect, which preventunauthorized persons from gainingaccess to computer facilities.

(obtain copies of proceduremanuals)

D. Assess the building's securityprogram and describe theequipment and/or other measures

the data facility uses to provideprotection. (e.g. CCTV)

E. Determine that the computer roomis equipped with locks to limitaccess, and those access devicesare properly assigned andaccounted for. (Access devicesmay be keys, magnetic cards, orcombinations.)

F. If keys or magnetic cards are used,verify that they are accounted forby an inventory control andrecovered if the assigned individual

leaves the Company's employmentor moves to a job that does notwarrant access to the computerfacility.

G. If combination locks are used,verify that they are changed on aregular basis to ensure that theusefulness of a combination knownto a former employee would beshort-lived.

H. Determine the basis on whichindividuals are given keys, cards,or combinations to the computer

room. Access should be on a need-to-enter basis only. (For example,the president does not have a needto enter, but the computeroperator does. Need is not afunction of rank, but of jobresponsibilities.)

(obtain procedure manual)

I. Through observation, determinethat doors to the computer room


3/5

STANFORD UNIVERSITY


DATA CENTER REVIEW


REF.

are kept locked at all times.

J. Determine that a log of access tothe computer room is maintained.

The log should contain at least thesignatures of individuals who arenot regularly on duty in thecomputer room.

K. Determine that when anyone whois not regularly assigned to thecomputer room enters the securearea, that individual has to sign anentry log.

L. Verify that a list of personsauthorized to be in the computerroom is posted in plain sight, and

that individuals not on the list arerequired to be accompanied byindividuals who are so authorized.(No one should be allowed in thecomputer room, including check-processing areas, withoutauthorization or sponsorship andwithout the presence of an officialwho is authorized to grant accessto the computer room).

M. Determine that service techniciansare identified by official documentsfrom their employers until they are

well known and recognized by thestaff of the computer room.

N. Determine how any unauthorizedhardware components added tothe network would be detected.

III FIRE PROTECTION SYSTEMS (describe Fire Protection Systems)

A. Ascertain if the computer room hasan adequate and safe fire-suppression system withassociated detectors (heat, smoke,and water) and whether othernecessary environmental controls

are in use.B. Ensure fire-suppression equipment

would effectively extinguish fireswithout harm to equipment anddocuments in the computer room.

C. Confirm that the area immediatelysurrounding the Data Center is freefrom combustible materials. (Note:

Physical Security over Data


4/5

STANFORD UNIVERSITY


DATA CENTER REVIEW


REF.

Centers must extend to the areasimmediately surrounding the Data

Center. The reason for this isattributed to the fact that mostfires start outside the Data Centerand then spread in.)

D. Determine that the computer isprotected by an UninterruptiblePower Source (UPS) to ensuresmooth transition of operations inthe event of power failure.

E. The computer room should be keptclean at all times.

F. Determine if fire protectionsystems are regularly tested.

IV ENVIRONMENTAL

CONTROLS

A. The environmental equipment andcontrols should be adequate toprotect the computer hardwarefrom damage. Use the followingareas as a guideline in determiningadequacy.

B. Ventilation and air conditioningshould be adequate to maintainappropriate temperature levelspecified by the manufacturer.

C. Recording thermometers andhumidity indicators should belocated so the readings can beobtained easily. A trained personshould monitor these instrumentson a routine basis.

D. The hardware should automaticallyshut down to protect itself fromdamage if unacceptabletemperatures reached.

E. The computer equipment shouldbe subject to periodicmaintenance, cleaning andinspection and a record kept ofsuch.

F. The computer room ceiling shouldbe adequately constructed toprevent water from entering thecomputer room.

G. Overhead water steam and pipesshould be avoided.

H. Adequate drainage should be


5/5

STANFORD UNIVERSITY


DATA CENTER REVIEW


REF.

provided.

I. Are the floors raised?J. Independent air conditioning

system with backup power supplyshould be installed.

V EMERGENCY PROCEDURES

A. Determine if the posted emergencyprocedures address:

Instructions for shuttingoff utilities.

Instructions forpowering down equipment.

Instructions for

activating/deactivating firesuppression equipment.

Personnel evacuation.

Security valuable assets.Determine if emergency proceduresare conspicuously posted throughoutthe organization.

Determine whether employees arefamiliar with their duties andresponsibilities in an emergencysituation and whether an adequateemployee-training program has beenimplemented.

Determine the notification proceduresto: Management andClients/CustomersConfirm that backup copies of data aremaintained in off-site.

VI CONCLUSIONS:

data center review audit program

Documents