The Capitoline Data Centre Operational Management ISO 22237 (DCOM) facility certification process is designed to identify missing documentation by producing a GAP analysis and where appropriate give the operator the opportunity to upgrade existing documentation and produce new documentation to fill the gaps with the aim of achieving certification to one of 3 Maturity Levels thereby improving reliability, efficiency and security of the facility.
A review of existing policies and procedures, documentation and management practice is undertaken against the requirements of ISO 22237-7.
They are also compared to the best practices identified by Capitoline from auditing hundreds of data centres and those taught in Capitoline’s DCOM Data Centre Operations Management training.
The review will also take into consideration elements of the following standards;
- ISO 27000 (physical security and non-software related management procedures)
- ISO 9000 (Documentation control)
- AMS-IX data centre business continuity standard. Amsterdam Internet Exchange is the largest in the world. Capitoline developed an operational management and business continuity standard especially for data centres wishing to connect into the AMS-IX network
In order to carry out the audit Capitoline will need to see all the documents identified in ISO22237-7 Management and operational information standard. A full list of the documents required for each maturity level is shown below.
Summary of the ISO22237 DCOM certification process.
The steps in the auditing and certification process are outlined below;
- First the operator provides copies of all the documentation identified above, where it exists.
- Capitoline perform a GAP analysis and produce a report identifying where documents are missing or fall short of the requirements. The report will identify which DCOM level of maturity is met by the documentation or which is most easily achieved by upgrading the documentation.
- The DC operator then upgrades the documentation where necessary.
- Once the operator is confident the necessary changes have been made Capitoline carries out a detailed audit of the documentation and processes during which the DC Operator will be expected to demonstrate that the processes are understood by staff and evidence must be produced to show they are being followed.
- If appropriate a certificate is produced
- In the next two years annual surveillance audits are then carried out to confirm the processes are still up to date and being followed and the certificate is renewed for a further year.
- Before the end of 3 years a recertification must be undertaken which includes a full audit of the documentation and processes.
Summary of the ISO22237 DCOM certification process.
Production of a certificate
If the DCOM processes and procedures, in our opinion, meet the requirements of one of the DCOM ISO22237 Maturity Levels then a certificate will be provided confirming this.
Annual Surveillance Audits
In order to maintain certification annual surveillance audits must be carried out to ensure there are no changes to the infrastructure which may compromise the certification criteria. These will follow the same process as the original audit.
Re-certification
Prior to expiry of the certification a re-certification audit must take place to ensure continuity of certification.
