Introduction
Data centres are at the core of many organizations. Downtime, of applications or the data centre itself, could lead to major direct and indirect losses to the business. This has led many organizations to build resilience at various levels such as at the data centre infrastructure and at the ICT layer. Fact is though that most companies are either over- or under spending due to the fact that many organizations have not been able to answer basic questions such as ‘what is the cost of downtime’ being it per application and/or the data centre itself.
Without knowing the cost of downtime it would be impossible to determine what level of investment is justi ed to mitigate the risks of downtime. This has led to the fact that many data centres have been built at potentially a Tier-4 level as per the
ANSI/TIA-942, whereas from a business perspective a Tier-3 level would have been enough.
Risk management is the process to identify vulnerabilities and associated threats, to be followed by estimating the level of risk that they may face and how they might impact the organization if these risks were to emerge. Based on international standards
(ISO/IEC27001:2005) and guidelines (ISO/IEC 27005:2011, NIST
800-30, ISO/IEC 31000/31010), the Certi ed Data Centre Risk
Professional course is a two-day course designed to expose attendants to the overall risk management process.
Focus is on both the data centre infrastructure and the physical data centre facility and equipment; the attendant will learn how to identify and quantify risk in their organization, creating the ability to reduce the risk to a level acceptable for the organization to allow them to make sound investment decisions based on facts rather than emotions. CDRP® is a must for every organization that wants to manage their risk without over spending.
Roadmap
CERTIFIED DATA CENTRE RISK PROFESSIONAL
Audience
The primary audience for this course is an IT, Facilities or Data
Centre Operations professional working in and around the data centre (representing both end-customers and/or service provider/facilitators) and having responsibility to achieve and improve hi-availability and manageability of the Data Centre, such as: Data centre managers, Operations / Floor / Facility managers,
IT managers, Information security managers, Security professionals,
Auditors / Risk Managers / Professionals responsible for
IT/corporate governance.
Prerequisites
While there are no speci c requirements for this course, participants with at least three years of actual experience in data centre and/or
IT infrastructures is recommended. This experience may come from a business or IT background but it is believed that the candidate has knowledge of both environments, understanding the mission of their organization. Having attended CITM® and/or
CDCP® isrecommended but not a requirement.
Global Accreditation
Understand the di erent standards and methodologies for risk management and assessment
Establish the required project team for risk management
Perform the risk assessment identifying current threats, vulnerabilities and the potential impact based on customized threat catalogues
Report on the current risk level of the data centre both quantitative and qualitative
Anticipate and minimizing potential nancial impacts
Understand the options for handling risk
Continuously monitor and review the status of data centre risk present
Reduce the frequency and magnitude of incidents
Detect and respond to events when they occur
Meet regulatory and compliance requirements
Support certi cation processes such as ISO/IEC 27001:2005
Support overall corporate and IT governance
Course Bene ts
After completion of the course the attendee will be able to:
Certi ed Data Centre Expert
Certi ed
Data
Centre
Facilities
Operations
Manager
Certi ed
Data
Centre
Risk
Professional
Certi ed
Data
Centre
Safety
Manager
Certi ed
IT
Manager
Certi ed Data Centre Specialist
Certi ed Data Centre Professional
Data Centre Design / Build Data Centre Operations / Governance
Certi ed
Data
Centre
Migration
Specialist
Course Syllabus
Introduction to Risk Management
Risk management concepts
Managements’ concern
Enterprise Risk Management (ERM)
Information technology risk and the business
Information security risk management
Data centre risk
Bene ts of risk management
Data Centre Risk and Impact
Risk in facility, power-, cooling-, and re suppression infrastructure and IT services
Impact of data centre downtime
Main causes of downtime
Cost factors in downtime
Standards, Guidelines and Methodologies
ISO/IEC 27001:2005, ISO/IEC 27005:2011,
ISO/IEC 27002:2007
ISO/IEC 27005 in relation to ISO/IEC 27001 ISMS
NIST SP 800-30
ISO/IEC 31000:2009
SS507:2008
TIA/ANSI-942
Other methodologies (CRAMM, EBIOS, OCTAVE, etc.)
Risk Management De nitions
Asset
Availability / Con dentiality / Integrity
Control
Information processing facility
Information security
Policy
Risk
Risk analysis / Risk assessment / Risk evaluation /
Risk treatment
Threat / Vulnerability
Types of risk
Risk Assessment Software
Risk assessment software
Automation
Considerations
Vendor selection
Risk Management Process
The risk management process
Establishing the context
Identi cation
Analysis
Evaluation
Treatment
Communicate and consultation
Monitoring and review
Project Approach
Project management principles
Project management methods
Scope
Time
Cost
Roles and responsibilities
Context Establishment
General considerations
Basic criteria
Risk appetite vs. risk tolerance
Scope and boundaries
Scope constraints
Organization for risk management
Training, awareness and competence
Risk Assessment - Identi cation
The risk assessment process
Identi cation of assets
Identi cation of threats
Identi cation of existing controls
Identi cation of vulnerabilities
Identi cation of consequences
Hands-on exercise: Identi cation of assets, threats, existing controls, vulnerabilities and consequences
Risk Assessment - Analysis and Evaluation
Risk estimation
Risk estimation methodologies
Assessment of consequences
Assessment of incident likelihood
Level of risk estimation
Risk evaluation
Hands-on exercise: Assessment of consequences, likelihood and estimating level of risk
Risk Treatment
The risk treatment process
Residual risk
Risk reduction
Constraints in risk reduction
Risk retention
Risk avoidance
Risk transfer
Control categories
Cost-bene t analysis
Control implementation
Communication
E ective communication of risk management activities
Risk Monitoring and Review
Ongoing monitoring and review
Criteria for review
Risk scenario’s
Risk assessment approach
Data centre site and facility
Force majeure
Organizational shortcomings
Human failure
Technical failure
Deliberate acts
Exam
Sample questions
Self study (time permitted)
Exam: Certi ed Data Centre Risk Professional
Delivery structure
EPI courses are lectured by certi ed trainers. CDRP® is an instructor-led course that uses a combination of presentation lectures and question and answer sessions, to discuss attendees’ speci c needs and issues experienced in their own environment.
The CDRP® course is approximately 80% lecture and 20% hands-on. Attendees are able to tap on the trainer’s extensive experience to solve practical problems in their current environment, adding tremendous value.
Examination
Certi cation exam papers can be taken in paper based format at the end of the last day of the course, or online via an authorised training partner, depending on the country in which the course is delivered. The exam is a one hour, 40 questions, multiple choice and closed book exam. The attendee need to have 27 out of 40 questions correct in order to pass the exam.
Results of the exam will be communicated to the attendee within four weeks following the examination.
Certi cation
Attendees who successfully pass the exam will receive the o cial ‘Certi ed Data Centre Risk Professional’ certi cate.
Certi cation is valid for a three years period after which the student needs to re-certify. More information on re-certi cation and veri cation of the current status of certi cation can be found
Global Accreditation
EXIN, is a global, independent and not-for-pro t examination provider. EXIN's mission is to improve the quality of the IT and
Data Centre sectors, the pro ciency of IT and Data Centre professionals and the IT users, by means of independent testing and certi cation. EXIN o ers candidates the opportunity to take examinations at a time and place of their choice. Every day, EXIN examinations are taken in more than 125 countries on six continents, and in more than 15 languages.
Recommended next course
Candidates with a desire to gain an understanding on IT management are recommended to take the CITM® course. CITM® is designed to expose participants to all the key aspects of a Data Centre / IT Operations /
Infrastructure department in a mission critical environment,
To further extend your skills in the Data Centre design arena, we recommend the CDCP® course. CDCP® exposes participants to the key components of the data centre.
For a full course outline of these courses visit the EPI
Course scheduling
Our courses are available in a wide variety of countries in all continents. For course scheduling visit the EPI corporate authorized reseller/partner.
extraction, in whole or in part, is allowed without express written permission from Enterprise Products Integration Pte. Ltd. EPI, its trademarks for logo, services and products are registered trademarks.
Authorised Reseller/Partner:
Asia/Paci c Headquarters:
Enterprise Products Integration Pte Ltd
37th Floor, Singapore Land Tower, 50 Ra es Place, Singapore 048623.
Local o ces in : Singapore, Malaysia, Japan, India, The Netherlands, UK, USA, France and South Africa
R13-01
Governance & Management Administration ISO/IEC-38500
Organization TC-260
ICT Services Management ISO/IEC-20000
Monitoring / Reporting / Control
ISO/IEC-90001
Environmental Sustainability
ISO/IEC-14000 - ISO-50001
Service Level Management
ISO/IEC-20000
Safety Management
ISO/IEC-18000
Security Management
ISO/IEC-27001
Project Management
PRINCE-2 / PMBOK
Organizational Resilience
Physical Infrastructure ANSI/TIA-942
Data Centre Location
ANSI/TIA-942 - ISO/IEC-24762
Building Management EN-15221
BC/DR
ISO/IEC-24762
BCM
ISO-22301
Facilities Management ISO/IEC-20000
ICT Infrastructure
EPI Data Centre Framework
The ‘EPI Data Centre Framework©’ provides Data Centre
Investors/Owners/Operators with a Data Centre Ecosystem
Data Centre. The Framework© addresses not only the site selection, design and out tting of its physical facilities but it also includes the governance and all processes required to organize and operate a Data Centre which meets the business requirements of its Customers. For
The Company
EPI Singapore is a British origin company operating world-wide via direct operations and a large partner network. EPI’s focus is on mission critical, hi-availability, environments. We have gained an international reputation as a company o ering an extensive range of data center infrastructure services including consultancy, audit, certi cation and training. We have developed an international reputation for high quality technical expertise, exibility, innovative techniques, personal service, and a powerful combination of capabilities and technologies.
All our services are aimed at helping our customers to:
Increase Availability of their mission critical infrastructure
Improve E ciency, E ectiveness and Manageability
Minimize risk of business interruption
All our clients have one thing in common – the need to protect their valuable data, run their mission critical infrastructure e ciently and be protected on a 24 x 7 basis. In protecting its customers, EPI is committed to an intensive program of comprehensive services development backed by engineering and support excellence.
Quality Systems and Procedures have been carefully created and adapted at every stage to ensure consistent and high quality services. We are known for our thoroughness, exibility and responsiveness of our project management. We work hard to provide unique solutions that t each organization and project, with an ethos to deliver quality on time, every time.
Let us put our expertise to work for you!
Data Centre Services
Consultation
- - Data Centre Design Validation
- - Data Centre Design Evaluation
- - Data Centre Review / Independent Second Opinion
Audit and Certi cation
- - ANSI/TIA-942
- - SS507
- - ISO/IEC-24762
- - ISO/IEC-27001
- - ISO/IEC-20000
Survey and Assessment
- - Power Quality
- - Cooling
- - EMF
- - Thermo Scanning
- - Physical Security
- - Customized Surveys
Programme scope, delivery arrangements and suitability are confirmed during enquiry.