CARRYING OUT SECURITY AUDIT AT URAN LPG TERMINAL AND CDC(CORPORATE DATA CENTRE SEWREE)

NIT and Scope for Execution of Security Audit of Corporate Data Centre Building, Sewree as per BPCL Security Manual 2020 Chapter 17. The vendor shall be executing the below jobs as mentioned below OBJECTIVE BPCL Corporate Data Centre Building, Sewree is one of the most critical installations in this day of data dependency. Data centre guidelines on physical and environmental security focus on ensuring the integrity of the data centre at all times. SCOPE BPCL Corporate Data Centre Building, Sewree is a specialized critical infrastructure which requires a higher level of security. The security controls for a data centre need multiple levels of redundancy to prevent unauthorized access and prevent operational down-time. FOLLOWING CATEGORIES ARE THE GUIDELINES FOR DATA CENTRE Telecommunication Industry Assessment (TIA) 942 data centre security guidelines lay down four layers of security. The same are detailed below: Successful Bidder shall be inspecting and auditing the below layers of BPCL Corporate Data Centre Building, Sewree a) First Layer - Perimeter Security b) Second Layer - Facility Controls c) Third Layer - Computer Room Controls d) Fourth Layer - Cabinet Controls First Layer – Perimeter Security Second Layer – Facility Controls Third Layer – Computer Room Controls Fourth Layer- Cabinet Controls Fencing – PIDS and motion-based vibration sensors Multiple Verification – PVC and third-party antecedent checks on all employees and contract staff Environmental Monitoring and Security – Security of BMS to ensure unauthorized access to prevent sabotage Key Management – Stringent key management and controls of locked data cabinets. Surveillance – 16:9 aspect ratio HDTV surveillance cameras with advanced motion analytics Visitor Management and Vendor Management systems integrated with access cards. Screening and Man traps- Depositing all mobiles and electronic devices within an access-controlled mantrap. Surveillance – All data racks and rack rows to be under focused surveillance. Motion based alerts to be issued. to the BMS room. Gate Controls – Access card readers for vehicles and pedestrians Access Zoning and Controls – Provision of man traps and multiple access control measures (card readers and pin pad) at all utility rooms Multiple Access Control – Unique card readers and biometrics to be used for access within the data hall. Anti-Sabotage measures – All critical cabling points to be fenced and to be kept access control. Communication Rooms should be accessed only by an authorized personnel and validation to be ensured through biometric access control. Page | 2 Patrolling – Guard tour management systems covering all vulnerable areas and critical utilities Material Management Dual checking of incoming and outgoing material. Material to be allowed only if an access mail has been generated by authorized personnel. Intrusion Detection: Intrusion detection alarms and local scare alarms to be installed. on all access doors and emergency push bar exits. Work Permit Control – Nature of work at the cabinet should be predefined. and communicated to the onsite security and BMS team Successful Bidder shall be inspecting and auditing the below layers of BPCL Corporate Data Centre Building, Sewree Perimeter Security at Data Centres: Check and record BPCL Corporate Data Centre Building Perimeter should be over 6 feet with top guards and fence intrusion detection system. The perimeter area including park areas to be covered under surveillance. 16:9 aspect ratio HDTV surveillance cameras with advanced motion analytics is recommended for external data centre surveillance. Access Control: Check and record BPCL Corporate Data Centre Building access control points to the data centre building are to be covered with proximity cards. Computer rooms, data halls, network operation centre, telecommunication rooms, electrical rooms, AHU (Air Handling Unit) rooms and DG rooms should be zoned as critical areas and should have proximity card readers along with biometric readers. As far as possible, man traps should be used as primary access points to data halls. Access cards and access rights should be reviewed periodically and the same should be recorded. Building emergency exits are to be installed with a push bar and local scare alarm. There should be no provision of entering the building from the outside via the emergency exit. Surveillance: Check and record BPCL Corporate Data Centre Building Data Halls all racks, rows and cabling points are to be under surveillance. Critical rooms such as server rooms, UPS rooms, DG rooms, roof areas etc. are also to be under the purview of surveillance. CCTV logs are to be maintained for a period of 60 days as a best practice and in accordance with TIA-942 guidelines. In addition, all building access points, material loading bays and gates are to be under surveillance. Screening: Check and record BPCL Corporate Data Centre Building should be stringent screening procedures before entering all data halls. Visitors and vendors are to deposit all storage devices such as mobile phones, laptops, pen drives and memory cards. A Hand-Held Metal Detector (HHMD) is to be used by security prior to entering the data hall. Laptops are to be used only within the admin areas and if required vendors are to be allowed laptops within the data hall only when their laptop details are being initially registered with the security personnel at the entry gate and the vendor must be escorted by an authorized BPCL employee before he/she enters Data Centre. Vehicle and Material Movement: Check and record in BPCL Corporate Data Centre Building Only authorized employee vehicles are to be allowed within the data centre premises. If visitors or authorized vendors are to enter the premises, prior intimation by mail should be given to security. Vehicles are to be screened and this should include boot checks Page | 3 and under vehicle scans. Materials are to be physically validated at the gate with the associated invoice/work order. An email detailing the nature of materials entering the premises should be generated in advance and the same is to be shared with security. Material loading and unloading at the material bay is to be carried out under the supervision of security and outgoing materials are also to be checked and recorded. Outgoing IT material details are to be shared in advance by the relevant stakeholder. to security. The details include make, model, and reason for transfer outside the facility and barcode details. Security Management: Check and record at BPCL Cor ok