chrisbst48/IT-Grundschutz-Compendium_2022_EN huggingface dataset:
INF.2.A14 Use of an Emergency Power System [Planner, Building Services] (S)
The power supplied to a data centre from the grid of an energy utility company SHOULD be supplemented by an emergency power system (EPS). If an EPS is in place, it MUST be regularly maintained. Load and functional tests, as well as test runs under load, MUST be conducted when performing maintenance. The operating supplies for an EPS MUST be checked regularly to see if they are sufficient. Regular checks MUST also be performed to ensure that these supplies are still usable, and especially to avoid diesel bug. If possible, low-sulphur heating oil SHOULD be used instead of diesel fuel. Refuelling operations MUST be logged. The log MUST include the type of fuel, the additives used, the date of refuelling, and the quantity refuelled. If an EPS is not used for a server room, a UPS with a run time appropriate for the protection needs at hand SHOULD be implemented as an alternative.
INF.2.A15 Overvoltage Protection Devices [Planner, Building Services] (S)
A lightning and overvoltage protection concept SHOULD be drawn up on the basis of the currently valid standard (DIN EN 62305 parts 1 to 4). The lightning protection zones (LPZ) required for the proper operation of a data centre must be defined. For all the facilities required for the proper operation of a data centre and its ability to provide services, this SHOULD be at least LPZ 2. All overvoltage protection equipment SHOULD be subject to a comprehensive test once a year in accordance with DIN EN 62305-3 (table E.2).
INF.2.A16 Air Conditioning in Data Centres [Planner] (S)
It SHOULD be ensured that suitable climatic conditions are created and maintained in a data centre. A data centre's air-conditioning system SHOULD have sufficient capacity. All the relevant values SHOULD be constantly monitored. If a value deviates from the norm, an automatic alarm SHOULD be triggered. Air-conditioning systems SHOULD be as fail-safe as possible in IT operational areas.
INF.2.A17 Use of Early Fire Detection [Planner, Building Services] (B)
A data centre MUST be equipped with an early fire detection system. A server room SHOULD be equipped with an early fire detection system. Early fire detection alarms MUST be routed to a continuously staffed department that can initiate a control and protective response within a maximum of three minutes. Alternatively, an automatic protective response MUST be initiated. In order to achieve a balance between fire protection and availability, it MUST be ensured that equipment providing redundancy is not located together within the effective range of the same voltage isolation circuit.
INF.2.A19 Functional Testing of Technical Infrastructure [Building Services] (S)
The technical infrastructure of a data centre SHOULD be tested regularly (at least once or twice a year) and following system modifications and extensive repairs. The results SHOULD be documented. In particular, entire reaction chains SHOULD be subjected to a real function test.
INF.2.A2 Formation of Fire Zones [Planner] (B)
Suitable fire and smoke zones MUST be defined for the rooms of a data centre. The fire and smoke zones MUST also provide protection that goes beyond the scope prescribed by building law for the technical equipment located therein and its availability. Fire and smoke MUST be prevented from spreading. In the case of a server room, it SHOULD be checked whether adequate fire and zones can be implemented.
INF.2.A21 Alternate Data Centre (H)
A geographically separate alternate data centre SHOULD be established. The alternate data centre SHOULD have sufficient capacity to maintain all of the corresponding organisation’s processes. It SHOULD always be ready for operation, as well. All of the organisation’s data SHOULD be mirrored to the alternate data centre on a regular basis. The switch to the emergency data centre SHOULD be tested and drilled regularly. The transmission routes to the alternate data centre SHOULD be suitably secured and designed with appropriate redundancy.
INF.2.A22 Implementation of Dust-Protection Measures [Building Services] (H)
During construction work in a data centre, suitable dust-protection measures SHOULD be defined, planned, and implemented. Persons who are not involved in the construction work themselves SHOULD check the dust-protection measures frequently to make sure they are working properly and the regulations on dust protection are being followed.
INF.2.A23 Appropriate Design of Data Centre Cabling [Building Services] (H)
Cable routes in data centres SHOULD be carefully planned and implemented. Cable trays in data centres SHOULD be carefully designed in terms of their arrangement and dimensioning so that separation of voltage levels and a sensible distribution of cables on the trays is possible, and that sufficient space is also available for future increases in demand. To ensure the optimal supply of IT hardware that has two power supply units, a two-line A-B supply SHOULD be set up from the low-voltage main distributor for the IT operating areas in question. Pairs of redundant lines SHOULD be laid in separate trays.
INF.2.A24 Use of Video Monitoring Systems [Data Protection Officer, Building Services, Planner] (H)
Site access control and intrusion detection systems SHOULD be supplemented by video monitoring systems. A video monitoring system SHOULD be integrated into the overall security concept at hand. The Data Protection Officer MUST always be involved in the planning, design, and potential evaluation of video recordings. The central technical components required for a video monitoring system SHOULD be installed in a suitable environment and protected. The video monitoring system SHOULD be tested regularly to ensure it is working properly and the angles of view agreed with the Data Protection Officer are being adhered to.
INF.2.A25 Redundant Design of Uninterruptible Power Supplies [Planner] (H)
UPS systems SHOULD be modular and designed to have a redundant module compensate for any failure without interruption. If a two-line A-B supply is set up for IT operating areas, each of the two current paths SHOULD be equipped with an independent UPS system.
INF.2.A26 Redundant Design of Emergency Power Systems [Planner] (H)
Emergency power systems SHOULD be redundant. With regard to maintenance, a redundant EPS MUST also be treated according to INF.2.A14 Use of an Emergency Power System.
INF.2.A28 Use of Higher-Level Alarm Systems [Planner] (H)
For areas of data centres with increased protection needs, VdS class-C alarm systems SHOULD be used exclusively (in line with VdS Guideline 2311).
INF.2.A29 Avoidance and Monitoring of Unnecessary Wiring [Building Services, Planner] (B)
In a data centre, the cables laid MUST be restricted to those that directly supply the technology installed there (usually IT and, if applicable, cooling technology). If it is unavoidable for structural reasons to run lines through a data centre in order to supply areas other than those within the data centre, this MUST be documented along with suitable justification. The risks posed by such lines MUST be minimised by appropriate safeguards (e.g. enclosures and monitoring). The aforementioned lines may be routed through server rooms without justifying why this is unavoidable, but they MUST be treated in the same way as described for data centres. Messages from systems that monitor such lines MUST be checked and evaluated immediately to determine whether a threat is present. Countermeasures MUST be implemented in a timely manner according to the threat level identified (see also INF.2.A13 Planning and Installation of Alarm Systems).
INF.2.A3 Use of an Uninterruptible Power Supply [Building Services] (B)
An uninterruptible power supply (UPS) MUST be installed for all operationally relevant components of a data centre. As the power consumption of air conditioning is often too high for a UPS, the control of these systems MUST at least be connected to the UPS. In the case of a server room, the necessity of operating a UPS SHOULD be checked based on the availability requirements of the IT systems at hand. The UPS MUST have sufficient capacity. If there are relevant changes in loads, checks MUST be carried out to establish whether the capacity of the existing UPS systems are still sufficient. In UPS systems that use a battery for energy storage, the battery MUST be kept within the required temperature range. For this purpose, it SHOULD be kept away from the power electronics of the UPS if possible. The UPS MUST be serviced and checked for functionality at regular intervals. The maintenance schedule specified by the manufacturer MUST be followed for this purpose.
INF.2.A30 Systems for Extinguishing or Preventing Fires [Building Services, Planner] (S)
A data centre SHOULD be equipped with an automatic extinguishing or fire prevention system.
INF.2.A4 Emergency Shutdown of the Power Supply [Building Services] (B)
There MUST be suitable options for switching off the electrical consumers in a data centre. Attention MUST be paid to whether and how an existing UPS is spatially and functionally integrated into the power supply. If conventional emergency stop switches are used, it MUST be ensured that the entire data centre will not be switched off. The emergency shutdown system MUST be subdivided in a systematic and sensible manner. All emergency off switches MUST be protected such that they cannot be activated unintentionally or without authorisation.
INF.2.A5 Maintenance of Air Temperature and Humidity [Building Services] (B)
It MUST be ensured that the air temperature and humidity in an IT operating area remain within the prescribed limits. The actual thermal load in the cooled areas MUST be checked at regular intervals and after major conversions. Any air conditioning systems in use MUST be maintained regularly. At minimum, temperature and humidity parameters MUST be recorded in a way that makes it possible to retrospectively identify whether thresholds have been exceeded as a means of both pinpointing and eliminating the cause of the deviation.
INF.2.A6 Site Access Control [Building Services] (B)
Access to a data centre MUST be controlled. Site access rights MUST be assigned in accordance with the specifications of module ORP.4 Identity and Access Management. It MUST be ensured that those who work at a data centre do not have access to IT systems outside their scope of work. All the possible ways to access a data centre MUST be equipped with site access control devices. Each instance in which a person accesses a data centre MUST be individually recorded by a site access control system. In the case of a server room, it SHOULD be checked whether it is appropriate to monitor all the possible ways to access the site in question. Regular checks MUST be carried out to determine whether the regulations regarding the use of site access controls are being observed. An organisation's requirements regarding its site access control system MUST be documented in a concept with a sufficient level of detail.
INF.2.A7 Locking and Securing Facilities [Employee, Building Services] (B)
All the doors of a data centre MUST always be kept locked. Windows MUST be avoided in the planning stage whenever possible. If there are windows, they MUST always be kept locked. Doors and windows MUST provide protection adequate for the security level at hand against attacks and external influences. They MUST have privacy screens. Consideration MUST be given to the structural design of all room-forming elements and their ability to provide a uniform level of protection.
INF.2.A8 Use of a Fire Alarm System [Planner] (B)
A fire alarm system MUST be installed in a data centre. It MUST monitor all areas. All the alarms of the fire alarm system MUST be forwarded appropriately (see also INF.2.A13 Planning and Installation of Alarm Systems). The fire alarm system MUST be serviced at regular intervals. It MUST be ensured that no particular fire loads are present in the rooms of a data centre.
INF.2.A9 Use of an Extinguishing or Fire Prevention System [Building Services] (B)
An extinguishing or fire prevention system in line with the state of the art MUST be installed in a data centre. If this is not possible, technical (especially a wide-area early detection system; see INF.2.A17 Early Fire Detection) and organisational measures (trained personnel and response plans for early fire detection alarms) MUST ensure that early fire detection alarms are responded to immediately and within no more than three minutes. In server rooms without an extinguishing or fire prevention system, hand-held fire extinguishers with suitable extinguishing agents MUST be available in sufficient number and size. It MUST be ensured that any additional building code requirements regarding the provision of hand-held fire extinguishers remain unaffected. The fire extinguishers MUST be mounted so that they are easy to access in case of a fire. Each fire extinguisher must be inspected and serviced regularly. All staff who are allowed to enter a data centre or server room MUST be instructed in the use of hand-held fire extinguishers.
INF.5 Room or Cabinet for Technical Infrastructure
Target Object: Building/room / Order: R2
INF.5.A1 Planning the Room Protection [Planner] (B)
Adequate technical and organisational requirements MUST be defined and implemented for a room for technical infrastructure. The level of protection to be achieved for the room MUST be considered. Planning MUST take into account both legal rules and regulations and potential hazards related to environmental influences, intrusion, and sabotage.
INF.5.A10 Maintenance of Air Temperature and Humidity [Building Services] (S)
It SHOULD be ensured that the air temperature and humidity in a room for technical infrastructure are within the limits specified on the data sheets of the equipment operated in the room. A suitable ventilation and air-conditioning system SHOULD be used for this purpose. This system SHOULD have sufficient capacity.
INF.5.A11 Avoidance of Pipes with Hazardous Liquids and Gases [Planner, Building Services] (S)
A room for technical infrastructure SHOULD only contain pipes that are absolutely necessary to operate the technology in the room. Sewage pipes, fresh water pipes, gas and heating pipes, and pipes for fuel or steam SHOULD NOT be routed through the space.
INF.5.A12 Protection Against Accidental Damage to Supply Lines [Planner] (S)
Supply lines outside a technical infrastructure room SHOULD be protected against accidental damage.
INF.5.A13 Protection Against Fire and Smoke Damage [Planner, Building Services] (S)
Irrespective of the building regulations pertaining to fire protection requirements that apply to a technical infrastructure room, all room-forming components, as well as doors and windows, SHOULD be equally smoke-tight. They SHOULD resist fire and smoke for at least 30 minutes. Fire loads in the vicinity of cable trays SHOULD be avoided.
INF.5.A14 Minimising Fire Hazards from Neighbouring Areas [Planner, Building Services] (S)
A technical infrastructure room SHOULD NOT be located in close proximity to other rooms with combustible materials in quantities exceeding typical office use.
INF.5.A15 Lightning and Overvoltage Protection [Planner, Building Services] (S)
A lightning and overvoltage protection concept should be developed and implemented in accordance with the principle of energetic coordination (see DIN EN 62305). A technical infrastructure room SHOULD be classified in accordance with lightning protection zone 2 (LPZ 2) at minimum. The lightning and overvoltage protection devices SHOULD be checked regularly to ensure they are fit for purpose and replaced if necessary.
INF.5.A16 Use of an Uninterruptible Power Supply [Building Services] (S)
The equipment that should be connected to a UPS SHOULD be checked. If a UPS is required, the backup time of the UPS SHOULD make it possible to shut down all the supplied components safely. Consideration SHOULD be given to the ageing of batteries in UPS systems. If there are relevant changes, the capacity of existing UPS systems SHOULD be checked. UPS batteries SHOULD be kept within the required temperature range. A UPS SHOULD be serviced and checked for functionality at regular intervals. For this purpose, the maintenance intervals provided by the manufacturer SHOULD be observed.
INF.5.A17 Inspection and Maintenance of Infrastructure [Building Services, IT Operation Department, Maintenance Personnel] (S)
At minimum, the recommended intervals and guidelines for inspection and maintenance recommended by the system manufacturer or those specified in standards SHOULD be followed for all components of physical and technical infrastructure. Cable and pipe penetrations through fire and smoke compartment boundary walls SHOULD be inspected to ensure that the partitions have the required approval for the purpose at hand and remain intact. Inspections and maintenance MUST be appropriately recorded.
INF.5.A18 Location of the Technical Infrastructure Room [Planner] (B)
Within the respective building, a technical infrastructure room SHOULD be located in a place that is not exposed to internal or external hazards such as rain, water, or sewage. On floors above ground level, care SHOULD be taken to ensure that the room is not heated by solar radiation. If the room is located on the top floor of the building, care SHOULD be taken to ensure that water cannot enter through the roof.
INF.5.A19 Redundancy of the Technical Infrastructure Room [Planner] (H)
A technical infrastructure room SHOULD be designed redundantly. Both rooms SHOULD have a dedicated electrical sub-distribution that is directly supplied by the low-voltage main distribution panel (LVMDP). Both rooms SHOULD be assigned to different fire zones and, if necessary, have their own respective ventilation and air-conditioning systems.
INF.5.A2 Location and Size of the Technical Infrastructure Room [Planner] (B)
A technical infrastructure room MUST NOT be a passageway. It MUST be ensured that sufficient space is available for escape routes and the work activities planned.
INF.5.A20 Enhanced Protection Against Intrusion and Sabotage [Planner] (H)
A technical infrastructure room SHOULD be windowless. If there are windows, they SHOULD be adequately secured against intrusion from the outside depending on the storey of their location. If, in addition to windows and doors, there are other openings necessary for operations (such as ventilation ducts), these SHOULD have the same protection as the room envelope. Intrusion detection systems SHOULD be used in line with VdS class C (according to VdS Guideline 2311). All required doors, windows, and other protected openings SHOULD be monitored via the intrusion system for closure, locking, and break-in. Any windows SHOULD always be closed. The resistance class of room-forming components, windows, and doors SHOULD be adapted to the security needs of the room in question. The quality of locks, locking cylinders, and security fittings SHOULD correspond to the resistance class of the door at hand.
INF.5.A22 Redundant Power Supply Design [Planner] (H)
In a technical infrastructure room, there SHOULD be a two-line power supply that runs all the way from the low-voltage main distribution board (LVMDS) to the consumer. These power supplies SHOULD be located in separate fire zones. The LVMDS SHOULD be redundant in operation.
INF.5.A23 Emergency Power Systems [Planner, Building Services, Maintenance Personnel] (H)
An organisation's energy supply SHOULD be supplemented by an emergency power system (EPS). The fuel supply for the EPS SHOULD be checked regularly. The EPS SHOULD also maintained at regular intervals. Load and functional tests, as well as test runs under load, SHOULD be conducted when performing maintenance.
INF.5.A24 Ventilation and Cooling [Planner, Building Services, Maintenance Personnel] (H)
Ventilation and cooling systems SHOULD be designed to be redundant in operation. It SHOULD be ensured that these systems are regularly maintained. In case of very high protection needs, maintenance redundancy SHOULD also be ensured.
INF.5.A25 Increased Protection Against Fire and Smoke Damage [Planner] (H)
Room-forming components, as well as doors, windows, and ventilation flaps, SHOULD resist fire and smoke for at least 90 minutes. The supply lines SHOULD guarantee a functional integrity of at least 90 minutes. In case of very high protection needs, the room envelope SHOULD be designed as a separate fire zone. Fire dampers controlled by smoke detectors SHOULD be installed in ventilation ducts. Cable trays SHOULD be routed through separate fire zones until they enter the room. In case of very high protection needs, an early fire detection system and an automatic extinguishing system SHOULD be provided. Fire and smoke detectors SHOULD be connected to the fire alarm control panel. The early fire detection system and the automatic extinguishing system SHOULD be connected to the two-line power supply with UPS and EPS.
INF.5.A26 Monitoring of the Power Supply [Planner, Building Services] (H)
Suitable monitoring equipment SHOULD be installed and operated that can detect prohibitively high currents on the protective conductor system and thus on cable shields (as well as potentially disturbing harmonic oscillations) and flag them in a suitable location for follow-up and remedial action.
INF.5.A3 Site Access Regulations and Control [Building Services, IT Operation Department] (B)
A technical infrastructure room MUST be protected against unauthorised access. There MUST be rules on who may enter the room, for which areas, for what purposes, and for how long. In this respect, it MUST be ensured that no unnecessary or excessive site access rights are granted. All instances in which a person accesses a technical infrastructure room SHOULD be individually recorded by a site access control system.
INF.5.A4 Protection Against Intrusion [Planner, Building Services] (B)
A technical infrastructure room MUST be protected against intrusion. Depending on the required security level of the room, suitable room-forming components SHOULD be selected, such as walls, ceilings, and floors, as well as windows and doors with appropriate resistance classifications in line with DIN EN 1627.
INF.5.A5 Avoidance of and Protection Against Electromagnetic Interference Fields [Planner] (B)
Electromagnetic fields MUST be avoided in the immediate vicinity of a technical infrastructure room. A sufficient distance to large machines such as lift motors MUST be maintained.
INF.5.A6 Minimising Fire Loads [Employee, Planner] (B)
Fire loads within and in the immediate vicinity of a technical infrastructure room MUST be minimised. Combustible materials MUST be avoided in room-forming components.
INF.5.A7 Prevention of Incorrect Use [Employee, Planner] (B)
A technical infrastructure room MUST NOT be used for other purposes (e.g. as a storeroom or cleaning cupboard).
INF.5.A8 Avoidance of Uncontrolled Electrostatic Discharge [Planner] (S)
A dissipative floor covering SHOULD be installed in a technical infrastructure room in accordance with DIN EN 14041.
INF.5.A9 Power Supply [Building Services] (B)
The power supply grid supplying a technical infrastructure room and the terminal equipment connected to it MUST be constructed as a TN-S system.
INF.6 Storage Media Archives
Target Object: Building/room / Order: R2
INF.6.A1 Hand-Held Fire Extinguishers [Fire Safety Officer] (B)
In case of fire, suitable hand-held fire extinguishers MUST be easily accessible in a storage media archive. These hand-held fire extinguishers MUST be inspected and serviced regularly. Employees working near a storage media archive MUST be instructed in the use of hand-held fire extinguishers.