Operations, Maintenance and Commissioning
What the domain tests
Operations, Maintenance and Commissioning tests how a facility is run and proven after it is built: procedural documentation, maintenance regimes, change control and the commissioning ladder from factory test to integrated systems test. Questions often present a scenario and ask which procedure or test level applies.
Documentation set
SOPs describe routine operations, MOPs describe a specific change with step-by-step actions, rollback and verification, and EOPs cover emergencies such as utility loss, UPS failure or cooling loss. A change advisory process reviews MOPs before execution. CMMS records planned maintenance, work orders, spares and asset history. Maintenance intervals should consider run hours, starts and condition data, not calendar dates alone.
Commissioning levels
Factory test (level 1), site acceptance (level 2), mechanical and electrical start-up (level 3), functional performance test of individual systems (level 4) and integrated systems test (level 5) where the whole facility is exercised together, often with load banks. The IST proves that the sequence works: utility fails, generators start and transfer, UPS carries the load, cooling recovers, and no single fault cascades. Scripted tests, trend data, thermography and relay calibration are typical evidence. Retro-commissioning re-proves an existing facility and catches drift.
Worked example
A new 2 MW hall has passed level 4 tests on each UPS and each chiller independently. The owner asks whether the facility is proven. No. Level 4 confirms individual systems, not interactions. Run a level 5 IST: drop utility at 80% load with load banks, verify generator start and transfer within the designed time, confirm UPS battery discharge and return, check that chillers and pumps restart in sequence, and confirm the BMS alarms and standby systems respond. Include a failure scenario such as one generator failing to start, to prove the topology tolerates it. Define pass criteria and rollback before the test, and record trends for comparison later.
Traps that cost marks
Calling level 4 an integrated test; testing only at light load; running a scripted test without a rollback plan; setting maintenance intervals purely by calendar; and failing to trend data so degradation is invisible.
Business Continuity
What the domain tests
Business Continuity tests whether you can connect facility resilience to business survival. The exam expects fluency with business impact analysis, recovery time and recovery point objectives, disaster recovery site strategies, dependency mapping and the testing that proves a plan works. The reference framework is ISO 22301.
Core metrics
A business impact analysis identifies critical processes and the maximum tolerable downtime. From that come the recovery time objective (how fast service must return), the recovery point objective (how much data loss is acceptable) and the recovery point in practice, set by replication lag and backup frequency. RTO and RPO drive architecture: a 15-minute RPO rules out overnight tape; a 4-hour RTO rules out rebuilding from scratch.
Site and architecture strategies
Hot, warm and cold sites differ in readiness. Active-active designs give near-zero RTO but demand data consistency and diverse fibre paths; active-passive with replication is common. Data center continuity depends on more than the building: carrier diversity, power contracts, fuel supply, staffing, spare parts and cooling water all belong in the dependency map. Crisis management covers command structure, communications, escalation and decision authority, including who may authorise a failover.
Worked example
A payment platform declares RTO 4 hours and RPO 15 minutes. The current design replicates asynchronously with a measured lag of 40 minutes at peak and has a warm site that needs 8 hours to scale up. Both objectives fail. Corrective actions: increase replication bandwidth or use change-data-capture to bring lag under 15 minutes, and pre-provision the warm site with sufficient capacity so activation takes under 4 hours. Then run a failover test during peak load to prove the figures, with a documented failback. The reasoning is that RTO and RPO are measured claims, not design intentions.
Traps that cost marks
Swapping RTO and RPO; assuming the disaster recovery site solves facility failures at the primary site; never testing failover under load; and ignoring telecom or supplier single points that defeat a perfectly redundant data center.
Risk and Compliance
What the domain tests
Risk and Compliance tests whether you can identify, score, treat and evidence risk, and distinguish a compliance certificate from actual resilience. Expect questions on risk registers, ISO 31000, control frameworks such as ISO/IEC 27001 and SOC 2, payment card and privacy obligations, supplier risk and audit evidence.
Risk method
Risk = likelihood x impact, scored on a documented scale, plotted on a heat map and recorded in a register with an owner, treatment and residual score. Treatments are avoid, reduce, transfer (insurance) or accept. ISO 31000 provides the process, not a checklist. Technical single points of failure belong in the same register as contractual and people risks: one fuel supplier, one fibre route, one certified operator.
Compliance frameworks
ISO/IEC 27001 certifies a management system, with physical and environmental controls in Annex A. SOC 2 reports on controls against trust criteria, with Type I covering a point in time and Type II covering an operating period. PCI DSS Requirement 9 governs physical access to cardholder data. Privacy rules such as GDPR restrict video surveillance and access logs. Industry rules for financial and critical infrastructure operators add outsourcing, incident reporting and resilience testing duties.
Worked example
A site has one fuel supplier with no backup and 24 hours of on-site fuel. Likelihood of a missed delivery during a regional event is scored 3, impact of a total outage is 5, giving a score of 15, high on the heat map. Treatment: contract a second supplier, increase on-site storage to 48 hours, add a fuel polishing and testing regime, and add the item to the audit sample. After treatment the likelihood drops to 2, giving a residual score of 10, which the risk committee accepts with a review date. The reasoning is that the score must be shown before and after treatment, with evidence and an owner.
Traps that cost marks
Treating a certificate as proof of security; confusing a SOC 2 Type I with Type II; leaving risks without owners or review dates; and failing to record residual risk and accepted exceptions.