Download Protection of electronic and telecommunications equipment

RISK CONTROL
REDUCE RISK. PREVENT LOSS. SAVE LIVES.
Protection of electronic and telecommunications equipment
Introduction
The following information outlines protection specifications for rooms containing telecommunications and electronic
equipment, such as electronic data processing rooms (EDP), server rooms, network rooms, data centers, and electronic
hardware and software test labs. The electronic equipment installed within these rooms is normally placed side by side in
rows, vertically stacked on multiple levels of shelving and placed within enclosed metal cabinets. As a result, the property
values per square foot and the total equipment value per room is substantial. In addition, because this equipment
supports the communications, data transfer and data storage for the insured and/or their customers, the business impact
of a brief shut down can be significant.
Proper design for property protection and business continuity requires complete management risk control programs and a
combination of physical fire protection features. When assessing the physical protection and management programs, the
following features should be evaluated:
•
Room location and design
•
Operating and emergency procedures
•
Electrical wiring and surge protection
•
UPS systems
•
Room security
•
Fire protection
•
Record protection
•
Disaster recovery and business continuity
Room location and design
•
Electronic equipment rooms should not be located in basements or below grade. This will reduce the risk of water
damage caused by surface water flooding.
•
Building water piping, gas piping and sewer lines should not run through or above the electronic equipment rooms.
•
Electronic equipment rooms should not be located next to any exterior building windows.
•
Electronic equipment rooms should not be located adjacent to high-hazard occupancies or storage areas.
•
Electronic equipment rooms should be segregated from other areas of the building with noncombustible 1-hour fire
resistance rated walls. If the room walls have windows, the adjacent areas should be light hazard office occupancies.
•
All doorways should be equipped with UL-listed automatic closing fire doors. The doors should normally be kept in the
closed position.
•
Openings where wires and cables penetrate walls, floors and floor/ceiling assemblies should be sealed. The fire rating
of the seal should be consistent with the rating of the wall being penetrated.
•
All construction materials within the room (walls, ceiling panels, flooring, etc.) should be noncombustible.
•
Air conditioning for the room should be independent from the remainder of the building. If this is not feasible, fire
dampers activated by smoke detectors should be installed in all ducted firewall penetrations. In addition, if the room is
cooled by the building air conditioning systems, the building systems should be evaluated to verify proper cooling is
being maintained during idle periods when the building systems are cycled down and/or turned off during weekends,
etc.
PAGE 1
RISK CONTROL
Protection of electronic and telecommunications equipment
•
Air conditioning units should not be placed above the electronic equipment. Water detection should be provided
around floor mounted air-conditioning units and or any areas susceptible to water collection.
•
Environmental conditions such as humidity and temperature should be monitored to minimize potential equipment
damage.
•
If the room has a sub-floor, a readily accessible floor panel lifter should be kept within the room in a visible location.
The sub-floor should be free of combustibles.
•
Waste containers should be listed metallic self-extinguishing containers.
•
Combustible storage should not be allowed in the equipment rooms. If a minimal amount of storage (paper goods,
electronic parts, tapes, etc.) is required within the room, the material should be stored in metallic storage cabinets.
Operating and emergency procedures
•
Strictly enforce no smoking regulations for the electronic equipment rooms.
•
Personnel should be trained and regularly drilled on the steps to follow in the event of an emergency, such as fire
alarms, domestic water leakage, loss of electrical power to the computer system, improper operation of the air
conditioning system, and fire or smoke in other areas of the building. These include de-energizing the computer
systems and other critical equipment, sounding the alarm to the public fire department or plant emergency
organization, firefighting with portable extinguishing equipment, closing the room doors, and salvage.
•
Establish a close liaison with the public fire department to have them review your fire protection equipment and
emergency procedures on an annual basis.
•
Duplicate records should be copied on a daily basis and they should be stored at an off-site location at least weekly.
For continued operation of the computer systems, it is extremely important that duplicate programs and records be
available if original records are lost. For additional information, please refer to “Computer Data Media Storage” on
Travelers Risk Control web site.
Electrical wiring and surge protection
•
An emergency shutoff switch should be installed at the main doorway of the critical equipment rooms interlocked to
de-energize the electronic equipment.
•
Power cables and electrical wiring should be placed in metallic jacketed cables or conduit. When non-metallic
jacketed cables are used under the raised floor they should be Type MI, Type MC or Type AC cable (see NFPA 70
Article 645-5(d)). When non-metallic jacketed cables are used in trays they should be listed Type TC cables in
accordance with NFPA 70 Article 340.
•
Voltage surge suppressors should be installed on all branch circuits for computers, communications equipment or
other sensitive electronic equipment to protect against voltage fluctuations. The voltage surge suppressors can be
“hard-wired” by a qualified electrician into the building electrical distribution system, or portable plug-in units can be
purchased and used to connect the electronic equipment to the building electrical outlets.
•
Surge arrestors should be installed on the power lines coming into the building to protect the electrical equipment and
communication lines from lightning surges. The surge arrestors should be installed on the line side of (before) the
main circuit breaker or fuse. Additional surge suppressors should be installed immediately upstream of critical
electrical equipment. Because of the variety and complexity of the protective devices available, the installing electrical
contractor must work closely with the equipment manufacturers to verify that appropriate devices are utilized.
UPS systems
For protection against power loss and voltage fluctuation, an uninterruptible power supply (UPS) should be provided for
any electronic equipment that cannot tolerate a power system disturbance. The level of protection will vary depending on
the equipment and business interruption value of the room.
PAGE 2
RISK CONTROL
Protection of electronic and telecommunications equipment
•
For lower valued operations, a battery operated UPS system should be arranged to instantaneously come on line and
maintain critical operations upon loss of power. The duration of the battery system should be adequate to allow
sufficient time for the critical operations to shut down without causing equipment damage or loss of data. Battery
banks should be in a separate, well ventilated, detached room.
•
For higher valued and equipment and systems critical to continued operations, a combination emergency generator
and battery back-up system should be installed. The system should be arranged so the battery system will
instantaneously come on line and maintain critical operations upon loss of power. The battery system must have
adequate capacity to maintain critical operations until the emergency generator can come up to speed and generate
the required electrical demand. Generators should be located in a separate machinery room or outside the building.
Room security
•
The entire building must be adequately secured to prevent burglary or vandalism. Street level (first floor), doors must
be of substantial construction and dead bolt locks provided. All accessible doors and windows should be equipped
with burglary alarms, or a motion detection system should be installed in the building.
•
It is preferred that electronic equipment room walls be of masonry construction. If fencing or sheet rock walls are
provided, it may be necessary to install a motion detection system in the room because these walls can be easily
breached. The level of protection will vary depending on the property and business interruption value of the room.
•
If high value inventory is stored in the room, the area should be equipped with perimeter alarms and should have a
single access point. Inventory should be checked regularly. Recorded video surveillance is also recommended.
•
Access to the rooms should be restricted to authorized personnel only.
Fire protection
•
Listed carbon dioxide or other clean agent type portable fire extinguishers should be placed in the rooms. Dry
chemical extinguishers should not be used in the equipment areas because, if discharged, they can cause extensive
contamination to the equipment.
•
A qualified individual or servicing contractor should conduct quarterly testing of the sprinkler system and alarms and
semi-annual testing of all other alarms. The system should use listed components, the alarms should be received at a
location that is constantly attended and the system should be installed in accordance with NFPA Standards.
•
Computer rooms should be protected with an automatic, wet pipe sprinkler system and early warning smoke
detection. A pre-action system sprinkler system could be considered only if the fear of potential water damage causes
wet pipe systems to be rejected.
•
The underfloor space should be provided with smoke detectors. Additionally, if this space has significant quantities of
cables present that are not in metal sheathing or conduit the underfloor space should be protected by a total flooding
carbon dioxide or clean agent system. Wet pipe automatic sprinkler protection and smoke detection are acceptable if
the underfloor space is at least 30 inches deep.
•
Where high values and a significant business interruption potential exist, a clean agent fire suppression system
should be considered in addition to the automatic sprinkler system. The installation should be an automatic, total
flooding system using a UL Listed/FM Approved clean agent. In those cases where the room is not protected with an
automatic sprinkler system, a “double shot” (connected reserve) system should be provided
Disaster recovery and business continuity
When an incident occurs, recovery requires up-to-date backups and proven methods of restoring the data. Some
organizations make daily backups, but never verify that the backups are actually working. Others construct backup
policies and procedures, but do not create restoration policies and procedures. The level of protection required will vary
depending on the property and business interruption value of the room.
•
For lower valued operations, the minimum requirement should be to perform a full weekly backup to an off-site
location and incremental backups every day. The backup media should be verified at least once a month by doing a
restore to a test server to ensure the data is being backed up accurately.
PAGE 3
RISK CONTROL
Protection of electronic and telecommunications equipment
•
For medium valued operations, it may be necessary to install redundant data transmission services, utility equipment,
etc., to minimize the possibility of an outage. If redundant systems are installed, the electrical and data lines should be
separated and arranged to minimize the possibility that both lines could be cut/damaged by a single incident.
•
For these medium valued operations, a complete inventory to identify all critical systems must be conducted. A risk
analysis should then be performed identifying what the risk and corresponding threat is for each critical system. The
backup policies and procedures should clearly map to these key servers. Once these systems have been verified, the
following should be validated:
1. Are there backup procedures for those systems?
2. Is the backup interval acceptable?
3. Has the backup media been verified to make sure the data is being backed up accurately?
4. Is the backup media properly protected in-house and with off-site storage?
5. Are there copies of the operating system and any restoration utilities stored off-site (including necessary license
keys)?
6. Have restoration procedures been validated and tested?
For high value or mission critical operations (operations that are dependent on the equipment for continued operations), it
may also be necessary to develop strategic partnerships and/or contract with cold sites or hot sites to ensure quick
replacement of the hardware and infrastructure needed to accommodate your disaster recovery team.
References
National Fire Protection Association:
Standard for Installation of Sprinkler Systems, NFPA 13
National Electric Code, NFPA 70
National Fire Alarm Code, NFPA 72
NFPA 75, Protection of Information Technology Equipment
NFPA 76, Recommended Practice for the Protection of Telecommunications Facilities
NFPA 1600, Disaster/Emergency Management and Business Continuity Programs
For more information, log in to the Risk Control Customer Portal at travelers.com/riskcontrol. (Need help? Read
our Registration Quick Guide.) You also can contact your Risk Control consultant or email [email protected].
travelers.com
The Travelers Indemnity Company and its property casualty affiliates. One Tower Square, Hartford, CT 06183
The information provided in this document is intended for use as a guideline and is not intended as, nor does it constitute, legal or professional advice. Travelers does not
warrant that adherence to, or compliance with, any recommendations, best practices, checklists, or guidelines will result in a particular outcome. In no event will Travelers or
any of its subsidiaries or affiliates be liable in tort or in contract to anyone who has access to or uses this information. Travelers does not warrant that the information in this
document constitutes a complete and finite list of each and every item or procedure related to the topics or issues referenced herein. Furthermore, federal, state or local
laws, regulations, standards or codes may change from time to time and the reader should always refer to the most current requirements. This material does not amend, or
otherwise affect, the provisions or coverages of any insurance policy or bond issued by Travelers, nor is it a representation that coverage does or does not exist for any
particular claim or loss under any such policy or bond. Coverage depends on the facts and circumstances involved in the claim or loss, all applicable policy or bond
provisions, and any applicable law.
© 2008-2014 The Travelers Indemnity Company. All rights reserved. Travelers and the Travelers Umbrella logo are registered trademarks of The Travelers Indemnity
Company in the U.S. and other countries. 262
PAGE 4