Cyber Essentials

Data centers must implement firewalls at network boundaries to control inbound and outbound traffic, with specific requirements for documenting firewall rules, testing rule effectiveness, and maintaining an audit trail of configuration changes.

Firewalls must be configured with default-deny policies for both ingress and egress traffic, with explicit allow rules defined only for necessary business communications.

For data centers, this includes managing firewalls at the perimeter, between network segments (DMZ protection), and potentially at the hypervisor or virtual machine level for cloud environments, with documented procedures for rule review and updates at least annually.

All IT assets including servers, network devices, and storage systems must be configured according to documented secure configuration standards aligned with vendor hardening guidelines and industry benchmarks such as CIS Controls.

Data centers must maintain an inventory of all devices, disable unnecessary services and ports, configure appropriate access controls at the OS level, and implement configuration management tools to detect unauthorized changes.

This requires baseline configuration documentation for each asset class, automated compliance scanning, and a formal change control process that prevents security-relevant configuration drift in production environments.

Data centers must implement role-based access control (RBAC) ensuring staff only have access privileges necessary for their designated functions, with multi-factor authentication (MFA) required for administrative access to critical systems.

All user accounts must be provisioned through documented processes, regularly reviewed for continued necessity, and deprovisioned promptly upon staff departure.

The standard requires segregation of duties to prevent single individuals from performing conflicting functions, documented procedures for access requests and approvals, and quarterly access reviews with management sign-off—particularly critical in data center environments where privileged access to physical infrastructure, virtualization platforms, and customer systems represents severe risk.

Data centers must deploy anti-malware solutions on all endpoints and servers, with automatic signature updates configured and regular scans scheduled during maintenance windows to minimize performance impact.

The requirement extends beyond simple antivirus to include behavioral analysis, sandboxing capabilities for suspicious files, and integration with security information and event management (SIEM) systems to detect malware propagation attempts.

Data centers must maintain logs of malware detections, analyze patterns to identify compromised systems or infection vectors, and establish incident response procedures specifically for malware-related breaches, including automated quarantine and recovery capabilities.

All systems must receive security patches and updates within defined timeframes based on vulnerability severity—typically critical patches within 14 days, important patches within 30 days—with documented procedures for testing patches in non-production environments before deployment to production.

Data centers must maintain an asset inventory tracking software versions, subscribe to vendor security advisories, and implement automated patching solutions where possible with fallback manual processes for systems where automation cannot be safely applied.

This requirement specifically addresses the data center challenge of maintaining patch compliance across thousands of systems while minimizing service disruption through coordinated maintenance windows and redundancy strategies.

Data centers must establish documented incident response procedures defining roles, escalation paths, and communication protocols for security incidents, with particular emphasis on detecting and responding to unauthorized access attempts or confirmed breaches.

The standard requires maintaining security logs with sufficient detail and retention period (typically 90 days minimum) to investigate incidents, conducting post-incident reviews to identify root causes and preventive improvements, and understanding obligations to notify affected parties and regulatory bodies within legally mandated timeframes.

Data center operators must test incident response procedures annually through tabletop exercises or simulations to ensure effectiveness.

Data centers must implement centralized logging and monitoring systems capturing security-relevant events from firewalls, authentication systems, privilege use, and critical applications, with logs protected against tampering and maintained for investigation purposes.

Monitoring must be sufficiently granular to detect suspicious patterns including failed authentication attempts, privilege escalation, unauthorized access to sensitive data, and unusual network traffic patterns.

The standard requires alerting on critical security events with defined response procedures, regular review of logs and alerts to identify missed detections or false positives, and capacity planning to ensure logging systems are never filled to maximum capacity, which would result in loss of audit trail.

For data centers supporting remote access by staff or contractors, the standard requires encryption of data in transit using TLS or equivalent protocols, VPN requirements for remote access to critical systems, and device management controls ensuring mobile devices accessing data center resources are appropriately secured.

This includes mobile device management (MDM) solutions enforcing screen lock requirements, encryption, and the ability to remotely wipe devices containing sensitive information.

Data center environments must distinguish between authorized remote access for legitimate administration and unauthorized access attempts, implementing network segmentation to limit what remote users can access.