Practice Guide on Data Centre Security
Data is a key element of new production in the digital era that ushers in innovation and drives high-quality development of the digital economy. To leverage the strategic role played by data in driving transformation and high-quality economic development, the Innovation, Technology and Industry Bureau (“ITIB”) published the Policy Statement on Facilitating Data Flow and Safeguarding Data Security in Hong Kong (“Policy Statement”) in December 2023. Data centres play a significant role to provide secure facilities for hosting IT systems and data. Data centre security is therefore crucial in protecting data assets and enabling high service availability of IT systems for supporting day-to-day business operations and delivery of digital services.
As one of the action items under the Policy Statement, the Digital Policy Office has formulated the “Practice Guide on Data Centre Security” (“the Practice Guide”) to strengthen the security of data centre infrastructure.
The Practice Guide highlights the objectives and best practices of data centre security, covering different aspects ranging from security management practices to the design and operational practices under a defence-in-depth security protection strategy.
Data centre service providers can make references to the practices proposed in this Practice Guide, and adopt the necessary practices in their data centres as appropriate, to safeguard security of their data centres.
The Practice Guide should be read in conjunction with the prevailing Baseline IT Security Policy (S17), IT Security Guidelines (G3) and relevant procedures, where applicable, for applying any security practices relevant to data centres and the associated IT infrastructures and systems.
