Document No.

ISMS/EQU/001
IT Operations
Equipment Siting & Protection

1. Approval and Authorisation

Completion of the following signature blocks signifies the review and approval of this Process
(signed copy held in safe)

Name Job Title Signature Date

th
Authored by:- Technical Support Officer 6 . December,2001
<Name>
Approved by:- Information Security Officer
<Name>
Authorised by:- Director of Finance and IT
<Name>

2. Change History

Version Date Reason

Draft 1.0 First draft for comments

Version 1.0 First Version

Version 1.1 Second version – to cover failure of emergency

lighting

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 1 of 9

Uncontrolled Copy When Printed

Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection

3. Contents
1. Approval and Authorisation ………………………………………………………………….1

2. Change History ……………...………………………………………………………………….1

3. Contents ……………………..………………………………………………………………….2

4. Abbreviations Used in this Report …………………………………………………………2

5. Introduction ………………… ………………………………………………………………….2

6. Equipment siting and protection Policy Statement ………………...………………..….3

7. Equipment siting and protection process …… …………………………………..……….3

7.1 Overview ……………………………………………………………………………….3

7.2 Siting ……………………………………………………………………………………3

7.3 Privacy of information on terminals ……………………………………………… 3

7.4 Protection of central server systems …………………………………………….. 4

7.5 General protection afforded by the computer room …………………………... 4

7.6 Food, drink and smoking …………………………………………………………… 5

7.7 Environmental monitoring ………………………………………………………….. 5

7.8 Special protection in industrial environments …………………………………. .5

7.9 Disasters in nearby buildings …………………………………………………….... 5

7.10 Problems in <Site 1> affecting the Computer Room ………………… 6

Appendix 1 - Maintenance contractors for <Site 1> ………………………...……… 7

Appendix 2 - Computer room cleaning ………………………………………………..………. 8

4. Abbreviations Used in this Report

UPS – Uninteruptible Power Supply

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 2 of 9

Uncontrolled Copy When Printed

Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection

5. Introduction
The Trust has two main types of IT equipment which, together, are used by its employees to do the work
of the Trust:

1. The central network and application servers (the latter holding the system known as xxxxx
[xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] through which and on which the
majority of the Trust’s work is done).

2. Stand-alone lap-top and desk-top pcs which, for the majority of work, are used as work-
stations to access the systems in 1) above – in particular the xxxxx system.

It is with 1) above, the siting and protection of the central network and application servers that this report
is mainly concerned.

The siting and protection of IT equipment in 2) above is largely the responsibility of the managers of the
individual departments where such equipment is being used. Advice and help for those managers can be
sought from the Information Technology Security Officer and the Desk-top Business Systems
Development Manager if required.

6. Equipment siting and protection policy

Equipment:

IT equipment should be installed and sited in accordance with the manufacturer's

recommendations.

Environmental controls will be installed where appropriate to protect central / key

equipment.

Such controls will trigger alarms if environmental problems occur. In such cases only
authorised entry will be permitted.

Smoking, drinking and eating is not allowed in areas housing major equipment and doors
should be kept closed at all times

Power Supplies:

Critical computer equipment will be fitted with battery back-up to ensure that it does not
fail during switchovers between mains and generator or can be closed down in a
controlled manner if there is no backup generator. Such battery power should be
sufficient for at least 10 minutes powered down at normal usage.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 3 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection
Such sites will have their own mains circuits not subject to power surges from other parts
of the organisation

7. Equipment Siting and Protection Process

7.1 Overview
x

All of the Trust’s central network and internal application severs are housed in a

purpose-built computer room (referred to in rest of this report as “the computer room”) at <Site 1>.

The computer room has a fire protection system, purpose built shelving and air-conditioning. This

facility houses the main xxxxx1system.

A copy of the xxxxx1 system, called xxxxx3, is housed at the Trust’s premises in Site 2. xxxxx3

serves the NHS Net user community.

This report covers the computer room at <Site 1>.

7.2 Siting
The computer room is out of the way, in the basement, thus minimising the general amount of
access.

7.3 Privacy of information on terminals

There are two sets of control monitors on the central network and internal application severs. One
set is located in the computer room and the other set is located in a locked room within the first
floor IT Operations area at <Site 1>. The second set of terminals is designed to reduce the need
for IT staff to access the computer room itself, as all non-physical access operations can be
performed on the second set. As both sets of monitors are within locked areas it reduces the risk
of work being overlooked.

It is the responsibility of managers of user-departments to ensure that IT equipment is sited in

such a way as to prevent overlooking of information on those systems. This covers positioning of
both lap-top and desk-top systems in the Trust’s premises and for users at remote locations
including those for home-workers. Advice and help for those managers can be sought from the
Information Technology Security Officer and the Desk-top Business Systems Development
Manager if required.

7.4 Protection of central server systems

All of the equipment centralised in the computer room is situated in the most substantial part of the
building, ie in the basement. The computer room has brick walls, water resistant ceilings, water
pumps, drainage channels and no windows.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 4 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection

7.5 General Protection Afforded by the Computer Room

The computer room is locked and protected by a steel clad door to protect equipment from the risk
of theft, damage, intruders or unauthorised staff.

There are fire alarms and fire suppression systems within the room. The fire alarms are linked to
the general alarm system within <Site 1> so that IT and building facilities management are alerted
in case of fire.

The general construction of the room makes it less likely that equipment in it will be at risk of
damage from explosive substances. Such substances are not used within the computer room.

The room is sealed against ingress of smoke and water. Air conditioning equipment within the
room are closed systems and do not use water as refrigerant. The refrigerant is air cooled before
re-circulating back to the computer room. Thus the air-conditioning units are independent of any
water supply interruption.

Dust protection is provided because the room is sealed. The air conditioning units slightly
pressurise the room so that the tendency is to blow any dust out when the door is opened.
The computer room is cleaned once a month by IT Operations staff – this is recorded on the Tape
Change Log – see the procedure for Information Back-up Appendix 6.

No equipment that can’t tolerate vibration is stored in the room. In general, most IT equipment is
not prone to damage from vibration and this is the case for equipment currently in use by the
Trust.

Within the computer room sensitive equipment is located in the centre of the room thus reducing
any effect of damage or interference to the room from outside.

Equipment in the computer room has no special environmental requirements and no chemicals
are used in the room.

All critical equipment has uninterrupted power supply (UPS) units to power equipment in the event
of electrical mains supply loss.

There are no special requirements to protect equipment from electromagnetic radiation.

The Trust is aware of the potential issue of mobile ‘phones affecting IT equipment and the effect
on back-up tapes. There are currently no special requirements with regard to the issue except that
mobile ‘phones should not be kept near tapes.

7.6 Food, drink and smoking

No food or drink of any sort should be taken into or consumed in the computer room. With
equipment used outside the computer room care should be taken to ensure that food and drink
does not get into IT equipment.

Smoking is banned from all parts of Trust premises.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 5 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection
7.7 Environmental monitoring
Checks are made on a daily basis to ensure that the air conditioning units are working – when the
tapes are changed. This check is recorded on the Tape Change Log (see procedure for
Information Back-up, Appendix 6). Periodic checks are made on the fire suppression system.
There is also periodic preventative maintenance on the air conditioning units. Details of
maintenance providers are given in Appendix 1.

7.8 Special protection in industrial environments

This is not applicable to the Trust’s equipment.

7.9 Disasters in nearby buildings

<Site 1> is largely isolated from other buildings in xxxxxxx. There are roads on three sides so
normal precautions need only be taken with regard to the Trust’s IT equipment being affected by a
disaster in another building. The computer room is the strongest room in <Site 1> – normal
precautions against such disaster were taken into consideration during its construction.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 6 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection
7.10 Problems in <Site 1> affecting the Computer Room
There are a number of problems which could occur in <Site 1>, but external to the computer room,
which could affect the computer room and staff working in it. In all of these situations the Facilities
Manager can override any decision to allow staff to continue working in the computer room
because it is no longer safe to continue working in the building.

In the event of an electricity supply failure the alarms & the fire suppression systems and
emergency lighting in the computer room would all operate on battery back-up but only for a short
time (between 40 minutes to 2 hours dependent on the drain on the batteries). A rough guide to
how long battery back-ups would last is indicated by how long the emergency lighting would last. If
the supply failure is short term then no specific action need be taken but if the failure is longer term
(ie longer than the servers UPS [uninterrupted power supply] can last) then a controlled shut-down
of the servers should be considered.

It should be noted that portable battery powered lighting (e.g. torches) should be kept in the
computer room in case of a supply failure and if the emergency lighting should fail – especially as
there are no external windows (which might provide daylight in such circumstances).

Portable lighting would allow staff to find their way out safely or to see to perform controlled server
shut-downs or other essential work in the event of normal and emergency lighting systems’ failure.
Such portable lighting should be checked as part of the monthly cleaning session (see para. 5 of
“General protection afforded by the computer room” above). Batteries for portable lighting should
be changed periodically in line with manufacturers’ recommendations.

An interruption to the water supply would soon make the building unfit for staff habitation. There
would be no drinking water and no water to operate toilets etc. In such circumstances it may be
possible to make special arrangements for IT staff to do essential work.

If the gas supply to the building was interrupted the impact would depend on the time of year. In
summer there would not be so much impact but winter there would be a problem with heating if
auxiliary heating could not be provided throughout the building.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 7 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection

Appendix 1: Maintenance contractors for

<Site 1>
The maintenance contractors for work at <Site 1> is Xxxxxx and their telephone number is (xxxxx)
xxxxxx. Xxxxxx is a “one-stop-shop” for all maintenance needs at <Site 1> as they are able to
arrange sub-contract work for areas they do not themselves cover.

The maintenance contracts for <Site 1> have the following computer room items on the list of
assets which are maintained by Advent:

air-conditioning units,
the fire alarms and
the fire suppression system.

The Trust’s Desk-top Business Systems Development Manager holds documentation relating to
the fire suppression and alarm systems.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 8 of 9
Uncontrolled Copy When Printed
Document No.
ISMS/EQU/001
IT Operations
Equipment Siting & Protection

Appendix 2: Computer Room Cleaning

Introduction
In order to keep the computer room as clean an environment as possible for the equipment kept
there and to present it as an impressive resource to visitors it is necessary to keep the computer in
a clean, orderly and presentable manner.

To achieve this it is necessary to clean the room on a regular basis (once a month). The tasks will
not be onerous and the whole cleaning session should only take around 30 minutes. It was
considered asking Facilities Management to arrange for the cleaning staff at <Site 1> to clean the
room. However, it was felt that this would be outside normal working hours and would require a
member of the IT Operations staff to be present while the cleaning is being done. Thus it would
be easier and more appropriate for the IT Operations staff to undertake the cleaning task.

When:
The 1st of every month or the closest convenient day to that for the staff on the rota for a particular
month.

Who:
All Reading-based IT Operations staff and the Desk-top Business Systems Development Manager
will be involved in the cleaning process.

Two staff each month, on a rota-basis, will clean the computer room. The rota will be displayed on
the IT Operations notice board and will be drawn up by the Helpdesk Administrator.

Where:
The inner computer room. The outer storage area is to be cleaned by Facilities Management.

What:
Vacuum clean floor.

Remove rubbish.

Clean visible surfaces.

Any other previously notified areas as required.

Materials and equipment:

The necessary equipment and materials should be obtained from the Facilities Manager or his/her
assistant.

Recording:
The cleaning session will be recorded on the Tape Change Log for the week that it takes place.

th
Exemplar_Equipment Siting and Protection V1.1.rtfx . xxxxxxxx, 2003 Page 9 of 9
Uncontrolled Copy When Printed