5.1Policy Objectives
This policy is intended to address the risk of unauthorised physical access to, damage to, or disruption of iomart data centres and the equipment and data they contain. The following objectives are set.
•Every individual entering a data centre is pre-authorised, identity-verified on arrival and recorded on the visitor record
•Every proximity access card issued is returned or deactivated on the day of issue
•Security Access Lists are reconciled with each colocation customer
•Every visitor is briefed on the site emergency evacuation arrangements at sign-in
•All hot work is covered by a valid permit and the suppression system set to manual
•All deliveries into and collections from site are logged and verified
•Physical security events are reported to iomart staff without delay and in any event within 24 hours of discovery
•All in-scope colleagues complete induction and annual refresher training
Performance against these objectives is reported to the Policy Working Group and, where relevant, to management review.
5.2Authorised Access and Identification
•Only individuals pre-approved by iomart and named on the Security Access List are permitted entry to a data centre.
•All visits must be arranged in advance via the Customer Control Panel, specifying the start time, expected duration and end time of the visit. Walk-in access is not permitted.
•Every visitor must present valid photographic identification on arrival. Identification documents are viewed to verify identity only; they are not copied or retained.
•Every visitor is issued with an identification badge or sticker, which must be worn visibly at all times while on site and returned on departure.
•Visitors must follow the instructions of iomart staff and security personnel at all times, and must comply with all posted notices and any change to site protocol notified to them during their visit.
•No person under 18 years of age is permitted to enter a data hall or equipment room.
5.3The Security Access List
•iomart maintains a Security Access List of all persons authorised to attend a data centre on behalf of each customer.
•Requests to add or remove individuals may only be made via the Customer Control Panel.
•The customer is responsible for keeping its Security Access List accurate and for removing individuals who no longer require access, without delay.
•iomart reconciles each Security Access List with the customer at least every six months. Entries that cannot be confirmed will be suspended.
5.4Access Cards
•Visitors attending on behalf of colocation customers are issued with a proximity access card.
•Proximity access cards are valid on the day of issue only and must be returned before leaving the building. They must not be taken off site.
•Access cards are non-transferable, may only be used by the individual to whom they are issued, and remain the property of iomart.
•Lost or stolen access cards must be reported immediately to iomart staff for deactivation. iomart reserves the right to charge for the replacement of a lost or stolen card.
5.5Escorting, Sign-In and Egress
•All visitors must sign in on arrival and sign out on departure. Each visitor leaving the site must sign out individually with a valid signature.
•All visits are accompanied. Visitors are given controlled access only to the areas for which they are authorised.
•Visitors are not permitted access to sensitive areas, including plant and build rooms, maintenance and equipment areas, staff working areas, and the rooms or racks of other customers.
•Visits outside pre-authorised dates and times will be refused.
•Visitor movement in and around the data centre and data halls is monitored, including by CCTV.
•Failure to follow the sign-in and sign-out procedure may result in future access being revoked.
5.6Third-Party Visitors
Where a customer wishes a third party to attend a data centre on its behalf, the following requirements apply. Any such visit is authorised entirely at the discretion of iomart, and iomart reserves the right to refuse a third-party visit whether or not these requirements are met.
•The visit must be arranged with iomart by the customer, not by the third party.
•The customer must inform iomart of the name of the third party, the nature and reason for the visit, and the fact that the individual is not an employee of the customer.
•The third party must comply with the terms of this policy in full.
•The customer remains responsible and liable for all acts, omissions and breaches of this policy by the third party.
5.7Colocation Customer Access
•Colocation customers with exclusive use of a rack or racks are permitted access to the relevant data hall, subject to the requirements of this policy.
•Colocation customers without exclusive use of a rack are not permitted access to any data hall. Such customers may use the Remote Hands service or, where facilities exist and at iomart's sole discretion, may have their equipment brought out of the data hall for access in an allocated room.
•Access to any other area, including other customers' rooms and racks, is prohibited.
•Colocation customers may request access to inspect their own rack for the purpose of meeting their own governance, risk management and compliance obligations. Any audit beyond this must be arranged in accordance with the Specific Service Schedule for customer audits.
•Colocation customers must collect their equipment on termination of the agreement or the relevant part of it.
5.8Conduct Within the Data Centre
•All internal doors must be kept closed at all times. External doors must be closed and locked.
•Smoking, including the use of e-cigarettes and vaping, is prohibited throughout the entire building.
•Photography or video recording anywhere within or of the data centre and its premises, including the data halls, is strictly prohibited.
•Mobile phones may be brought on site. All other radio transmitting devices are prohibited.
•Visitors must not operate any equipment that may result in unauthorised access to, disclosure of, modification of or loss of customer or company data, or that may cause unplanned downtime or service degradation.
•Visitors must not operate any equipment that may constitute a health or safety hazard. If in doubt, consult the Data Centre Services Manager.
•Food and drink are not permitted in equipment rooms, corridors or data halls.
•Vehicles, briefcases, bags and other personal items may be subject to security search. Any person refusing a search will not be permitted to enter or re-enter an iomart data centre.
5.9Fire Safety and Emergency Arrangements
•Every visitor is briefed on the emergency evacuation arrangements for that data centre on arrival. In the event of an emergency, visitors must follow those arrangements and the instructions of iomart staff.
•All data centres are fitted with fire detection equipment and all data halls are fitted with fire suppression equipment.
•In the event of a fire alarm, the gas extinguishing system may activate automatically.
•Fire exits, escape routes and emergency equipment must not be obstructed at any time.
•Any activity generating dust particles is prohibited without prior arrangement with iomart staff, as it may trigger the automatic alarm or gas suppression system.
5.10Hot Work
•Hot work is prohibited unless a valid hot work permit has been issued by iomart in advance.
•Visitors intending to carry out hot work must notify iomart staff so that the fire detection and suppression system can be set to manual rather than automatic operation for the duration of the work.
•The system must be returned to automatic operation and the permit closed on completion of the work.
5.11Health and Safety
•All visitors are responsible for their own health and safety and for that of others who may be affected by their acts or omissions while on site.
•Before commencing any work, visitors must inform iomart of any activity that may present a risk to health and safety and, where necessary, provide a risk assessment and method statement in advance.
•Hazardous materials, including batteries and electrical equipment, must be removed from site and disposed of in accordance with the Waste Electrical and Electronic Equipment Regulations.
•Lone working in data halls and plant areas is subject to the site lone working arrangements.
5.12Goods, Deliveries and Collections
•Visitors must declare to iomart staff all goods brought into and taken out of the facility.
•iomart maintains a log identifying and verifying all deliveries into and collections from each data centre.
•Customers must notify iomart via the Customer Control Panel in advance of any delivery or collection.
For a delivery, the following information is required:
•Expected day of delivery.
•Purchase order number for the equipment, if known.
•Vendor name and description of the equipment.
•Person to be contacted when the equipment arrives.
For a collection, the following information is required:
•Expected day the equipment will be collected.
•Vendor name, and the description and location of the equipment to be collected.
•Person to be notified once the equipment has been collected.
•iomart does not accept the risk of any goods or equipment delivered to or collected from site, and reserves the right to charge for the storage of any item left for more than two weeks.
5.13Equipment, Storage and Asset Records
•iomart's prior written consent must be obtained before any equipment is installed in, removed from or modified within a data centre, and before any work relating to customer infrastructure is performed, including construction and any activity that adds or removes assets.
•This is to confirm that the equipment can be accommodated within the available power, cooling and space capacity.
•Equipment serial numbers may be required to be recorded in the iomart hosting asset register.
•Equipment may only be installed in accordance with the procedure and conditions agreed with iomart.
•Storage of equipment is permitted only in designated equipment or storage rooms.
5.14Customer Equipment and Unattended Items
•Visitors are responsible for ensuring that their own and their customer's equipment is properly secured.
•Items must not be left unattended during a visit, or left unsecured after a visit. Unattended or unsecured items will be removed and may be destroyed.
•iomart does not accept liability for any loss, damage, cost, liability or expense incurred as a result of items left unattended or unsecured.
5.15Housekeeping and Environmental Obligations
•Clean working conditions inside data halls and equipment rooms are essential to the correct functioning of equipment.
•Waste, rubbish and packaging must not be left inside racks, as this restricts airflow and can lead to equipment overheating.
•Packaging materials must not be taken into data halls or equipment rooms. Boxes must be unwrapped in the designated area, and all packaging removed from site immediately and disposed of responsibly.
•Visitors must prevent pollution by minimising waste, recycling wherever possible and properly disposing of waste that cannot be recycled.
•Visitors are responsible for the environmentally responsible collection, storage and disposal of all redundant IT equipment in accordance with the Waste Electrical and Electronic Equipment Regulations.
5.16Reporting Irregularities and Security Events
•All irregularities, alarms and suspected or actual security events must be reported to a member of iomart staff without delay, and in any event within 24 hours of discovery.
•Reportable events include, but are not limited to, tailgating, doors found insecure, lost or stolen access cards, unaccompanied persons, missing equipment and damage to the fabric of the building.
•Reported events are recorded and triaged in accordance with the Group incident management process. Events with an information security or personal data dimension are escalated to Cyber Security and, where personal data is involved, to the Data Protection Officer.
5.17Personal Data and Privacy
•Personal data is processed under this policy only where there is a lawful basis for doing so.
•Personal data is processed to verify the identity of individuals seeking access, to control and record entry to and exit from our facilities, and to protect the security of our sites and the equipment they contain.
•The data processed may include name, employer, contact details, vehicle registration, visit records, access card records and CCTV images.
•The lawful basis for this processing is legitimate interests, being the security of our facilities and the protection of our own and our customers' assets. A legitimate interests assessment is held by the Data Protection Officer.
•Identification documents are viewed to verify identity but are not copied or retained.
•Where biometric access control is used at a site, biometric data processed for the purpose of uniquely identifying an individual is special category data under Article 9 of the UK GDPR. Such processing requires an identified Article 9 condition, a completed data protection impact assessment and a non-biometric alternative.
•Access logs, visitor records and CCTV images are retained in accordance with the Group retention schedule and then securely destroyed.
•Where access records are held in cloud-based management platforms, they are treated as cloud service customer data and handled in accordance with our obligations under ISO/IEC 27017 and ISO/IEC 27018.
•Further information on how we handle personal data, including individual rights, is set out in POL0007 Data Protection Policy and the relevant privacy notice. Data protection queries should be directed to dpo@iomart.com.
5.18Security Violations
Violations of data centre, system or network security are strictly prohibited. Examples include, but are not limited to:
•Allowing unauthorised access to the data centre, including by holding open a door or permitting another person to follow on a single card presentation.
•Use of any iomart product or service that the customer does not have permission to use.
•Use of any equipment, hardware, connections or other material that the customer does not have permission to use.
•Disruption of or interference with connectivity and access, or otherwise impeding another customer's use of the data centre, products or services.
5.19Continual Improvement
iomart is committed to the continual improvement of physical security at our data centres. Objectives set out at section 6.1 are reviewed for continued relevance at each management review. Findings from internal and external audit, security events, customer feedback and business continuity exercises are used to identify opportunities for improvement, and resulting changes are reflected in this policy and its supporting procedures.