Auditing Information Systems, Second Edition

7.4. GENERAL EMERGENCY AND DETECTION CONTROLS

Alarms can be triggered by smoke, fire, or a number of other specific actions (e.g., forcibly opening a restricted door). Alarms should be installed at strategic locations throughout a facility for both safety and security reasons. They should be electronically monitored on a continuous basis. Fire alarms are typically monitored by both security guards and the local fire department. Physical access alarms are normally monitored by security guards and, depending on the application, the local law enforcement agency. Alarms should also notify security management within the organization. The security guard procedures manual should specify whom the guards should notify, depending on the nature and type of alarm.

Heat-activated overhead sprinkler systems are required in most facilities. In the case of data centers, they may or may not be located above computer equipment, depending on the local fire code and the wishes of management. Overhead sprinkler systems should be installed even in areas where CPUs and other equipment are located for four reasons:

1. Employee safety would be maximized.

2. Fire damage can be contained in one area rather than being allowed to grow and spread, thereby risking the loss of the entire facility.

3. Most equipment should be insured (see the Insurance Coverage section for more details), so losses from water damage should not be a major concern.

4. If the organization has an effective business resumption plan, business operations ...