A data center failure can stop an entire business. Fire, flooding, power loss, a ransomware attack or a simple human error can all take critical systems offline. When you audit data centers and disaster recovery, you check that facilities are protected, operations are controlled and the organization can recover within agreed times.
This guide covers on-premises server rooms, colocation sites and cloud environments.
Scope
- Physical security and environmental controls.
- Power, cooling and fire protection.
- Operations: monitoring, change, maintenance and staff access.
- Backup and recovery.
- Disaster recovery (DR) plans and tests.
- Third parties, such as colocation and cloud providers.
Steps to perform the audit
- Gather documents: site plans, risk assessments, maintenance records, DR plans and test reports.
- Visit the site: walk through entrances, data halls, power rooms and loading areas.
- Interview staff: ask how they handle access, incidents and maintenance.
- Test controls: sample access logs, alarm records and backup jobs.
- Review DR: compare plans and tests with business recovery needs.
- Report: rank findings and agree on actions.
Physical security
- The building has defined security zones, with stricter control for data halls.
- Entry uses access cards or biometrics, and the system logs every entry.
- Staff escort and log all visitors.
- CCTV covers entrances and data halls, and someone reviews footage after incidents.
- Racks and cages lock where several tenants share space.
- The team removes access promptly when people leave.
Environmental controls
- Power: UPS units bridge short outages, and generators take over for longer ones. The team tests generators under load on a schedule.
- Cooling: redundant cooling keeps temperature and humidity within equipment limits, with alerts on drift.
- Fire: smoke detection, ideally very early warning (VESDA-type) systems, and gas-based suppression suitable for IT equipment.
- Water: leak detection under raised floors and near cooling units.
Operations
- Monitoring covers servers, network, power and environment, with on-call escalation.
- Changes follow an approved change management process.
- Vendors follow maintenance schedules, and staff supervise external engineers.
- The team wipes or destroys old disks and keeps certificates.
Backup and disaster recovery
Business impact and targets
A business impact analysis should set two targets for each critical service:
- RTO (recovery time objective): how fast the service must return.
- RPO (recovery point objective): how much data loss is acceptable.
Backups
- Backups follow the 3-2-1 rule: three copies, two media types, one off-site.
- At least one copy is offline or immutable, so ransomware cannot delete it.
- Backups are encrypted, and keys are stored separately.
DR plan and testing
- A written DR plan lists roles, contacts, decision points and step-by-step recovery.
- A secondary site, colocation space or cloud region can run critical services.
- The team tests the plan at least once a year, from tabletop exercises to full failover.
- Test results show whether real recovery times meet the RTO and RPO.
Cloud and colocation
When a provider runs the facility, you rely on their controls. Therefore, review their ISO 27001 certificate or SOC 2 report, check contract terms for availability and incident notification, and confirm that your own backups and multi-region design cover provider failures.
Common findings
Typical findings include untested generators, backups stored in the same building, DR plans that list former employees, and recovery tests that never happen.
Related guides
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
