Safety, Security and Environmental Management: Layered Controls and Operating Envelopes
Safety, Security and Environmental Management
This domain tests the controls that protect people, assets and the operating environment. It covers physical security layers, health and safety risk control, fire detection and suppression, and the temperature and humidity envelope that keeps IT equipment reliable. The exam expects you to know the difference between recommended and allowable environmental limits and to apply layered security rather than single-point measures.
Core rules and concepts
- Security is layered: perimeter, building, data hall, rack and logical access. Controls include access control, mantraps, visitor escort, background checks, CCTV retention, key control and tailgating prevention.
- Safety follows a risk assessment and hierarchy of controls: eliminate, substitute, engineer, administrate, then PPE. High-risk work needs permit to work, LOTO, arc-flash assessment and appropriate PPE.
- Fire protection includes detection such as aspirating smoke detection, suppression such as clean agent, water mist or pre-action systems, and procedure. Suppression must not endanger occupants; evacuation and investigation follow.
- Environmental monitoring tracks inlet temperature, humidity, dew point and leak detection. ASHRAE TC 9.9 distinguishes recommended and allowable envelopes; operating outside recommended increases failure risk and energy use.
- Security incidents, near misses and environmental excursions need reporting, escalation and trend review.
Worked example
A cold-aisle sensor records 29°C at the inlet for 25 minutes. The site policy uses the ASHRAE recommended envelope of 18–27°C. The reading is 2°C above the recommended maximum, so it is an excursion, not automatically an equipment failure. Check whether it is a sensor fault, a cooling-unit failure or a containment leak; review rack inlet sensors, UPS load and CRAH status; confirm whether any equipment has a higher allowable rating. If the excursion exceeds the allowable envelope or persists, invoke the incident process and notify affected customers under the SLA. Reasoning: classify against the correct envelope, then investigate cause and duration before escalation.
Traps that cost marks
- Treating the allowable envelope as the normal operating target.
- Equating fire suppression with fire prevention or security.
- Relying on CCTV without retention, access and review rules.
- Applying PPE as the first control instead of the last.
- Failing to distinguish a security incident from a safety incident in reporting.