Data Centre Governance and Risk
The Data Centre Governance and Risk domain tests how the facility is directed, controlled and protected at organisational level. Questions cover governance frameworks, risk assessment, business continuity, third-party risk and compliance evidence.
Governance building blocks
- Frameworks: ISO/IEC 38500 for IT governance, COBIT for control objectives, ISO 31000 for risk management, ISO 22301 for business continuity. Governance sets direction; management executes it.
- Roles and accountability: board or executive sponsor, data centre manager, security officer, risk owner, compliance and audit functions. A risk owner must have authority to accept or treat the risk.
- Risk process: identify assets and threats, analyse likelihood and impact, evaluate against risk appetite, treat through avoid, reduce, transfer or accept, then monitor residual risk. Maintain a risk register with owners and review dates.
- Business continuity and DR: business impact analysis identifies critical services; define RTO (time to restore) and RPO (acceptable data loss). Test and update recovery plans.
- Third parties: due diligence, contractual SLAs, right-to-audit clauses, confidentiality, subcontractor controls and exit plans.
- Compliance and safety: audit evidence, regulatory obligations such as GDPR, local health and safety, refrigerant and energy reporting, plus ESG disclosures.
Worked example
A single fibre route has an estimated 20% annual failure probability and a €1.5 million impact. The expected annual loss is 0.20 × €1.5m = €300,000. A diverse second route costs €150,000 to install and €20,000 a year to maintain. The treatment is justified on expected-loss grounds, but the decision also depends on risk appetite, service criticality and residual risk. Record the calculation, owner, decision and review date in the risk register. Reasoning: quantify where possible, then apply governance judgement.
Traps that cost marks
- Confusing RTO with RPO: RTO is recovery time; RPO is acceptable data loss.
- Treating risk assessment as a one-off document rather than a reviewed process.
- Ignoring third-party and supply-chain risk because the vendor is external.
- Writing a DR plan without testing it or defining recovery dependencies.
- Assuming governance is the same as documentation; it requires accountability and decision rights.