Introduction
IT systems and facilities are critical to university operations; it is therefore necessary to provide reliable infrastructure for systems operations in order to minimize the chance of service disruptions. Information security is also a concern and an environment must be maintained that minimizes the risk of a security breach.
The Data Center is a restricted area requiring a greater level of control than normal workspaces. Only those individuals who are expressly authorized may enter this area.
This document establishes guidelines for access and physical security related to the Data Centers. The procedures and policies described in this document must be followed by all individuals working in or visiting the Data Center. Failure to comply with these rules, or other behavior deemed inappropriate or that poses a risk to these facilities or their systems, may result in the loss of access and the incident may be reported to the employee's supervisor and/or director.
Physical Access
- All Data Center customers are required to be affiliated with the University of Colorado and possess a Buff OneCard.
- Every user is required to have a PIN set on their Buff OneCard.
- Authorization applies only to the named individual, is not transferable, and does not permit that individual to extend access to any other person.
- Third party vendors providing support for IT systems are permitted in the facility only with a Data Center customer escort.
- Any tours of the facility must be coordinated directly with OIT Data Center Management staff.
- Data Center and security doors will remain locked or secured at all times. Doors to the Data Center are never to be propped open.
- Extreme caution should be exercised to ensure that unauthorized persons do not gain access to the facility by “tailgating”.
General Work Rules
- Customers must carry proper UCB identification with them at all times within the Data Center. Falsifying or withholding one’s identity or refusing to cooperate with Data Center personnel is a violation of these rules.
- Escorted vendors are required to have proper state and/or company issued identification at all times when performing work within the Data Center.
- Data Center management staff reserves the right to exclude any individual from the facility. Anyone requested to leave the Data Center must do so peacefully and immediately.
- All Customers and Visitors agree to report any violation of these Rules or University policies, or any other suspicious or improper activity to the OIT Data Center management staff.
- Customers and Visitors are solely responsible for their personal belongings and property while on the premises.
- Touching, inspecting, documenting, photographing or any form of tampering with OIT or other customer(s) equipment is strictly prohibited. Persons seen engaging in such activity will be reported and may be subject to expulsion from the facility.
- The use of tobacco products of any sort shall be prohibited on all university-owned and operated campus grounds both indoors and outdoors. For more information please see CU's No Smoking Policy.
- Customer and Visitor use or visitation of Data Centers is contingent upon compliance with all University policies and rules.
- Food and drink are not permitted within the Data Center, including sealed containers.
- Liquids of any type are not allowed in the Data Center.
- All unpacking activities must occur outside the Data Center in designated staging areas. Absolutely no cardboard, plastic, packing peanuts, paper wrap, wood or other such materials are allowed in the Data Center.
- The Data Center team must be consulted for any new equipment to be installed in the Data Center. It is advisable to consult with the Data Center team as early as possible to confirm the necessary space, power and cooling will be available upon arrival for your equipment.
Safety
Data centers can be hazardous due to the presence of high voltage electricity and trip hazards. In order to minimize the risk of personal injury, the following rules will be observed.
- Avoid safety cones, barricades, caution tape, or other safety equipment that has been installed to guide you around hazardous areas including open floor tiles.
- The Data Center & staging area must be kept as clean as possible. All individuals in the Data Center are expected to maintain a clean working environment and clean up after activities as required. Boxes and trash should to be disposed of properly.
- Closed-toe footwear will be worn at all times while in the Data Center. Extreme caution should be used when wearing high heel shoes; this footwear may pose a risk while walking across certain perforated floor tiles.
- No network cables or power cord should be strung along the floor creating a trip hazard.
- Due to the noise volume within the Data Center itself, the use of hearing protection is recommended. The use of noise canceling headphones, earphones, etc. for the enjoyment of personal music is not recommended and my not be a suitable substitute for hearing protection.
Equipment Standards and Security
- Customer-owned equipment, and the software run on said equipment, remains the property and responsibility of the customer.
- Customer is responsible to ensure that their equipment and software is in compliance with University and campus IT policies and standards, including but not limited to the campus' Acceptable Use Standard and Secure Computing Standard for Servers. In particular, it is the customer's responsibility to ensure that their equipment is being used for appropriate and allowable purposes and that their equipment is running current, supported operating systems and software.
- Customer is responsible to ensure that operating system and application security updates are applied in compliance with the Vulnerability Management Standard.
Emergencies
- In the event of an emergency, exit the facility immediately and dial 911. Do not stop to collect personal belongings, and do not activate the Emergency Power off Button (EPO).
- The EPO is only to be used in the event of a life threating electrical emergency, such as electrocution or electrical fire. Activating the EPO in a situation that is not a life threatening electrical emergency will have a grave impact on the University, its departments and critical IT services.
- Violations of these rules or any nonemergency Data Center incidents should be reported to the Data Center Manager. Emergencies should be reported directly to the University of Colorado Boulder Police Department (CUPD) immediately or by calling 911.
