An Information Security Management System (ISMS) is designed to protect information assets through structured controls, policies, and risk management practices.

EPI aligns with globally accepted security frameworks (e.g., ISO/IEC 27001), where the foundation of an ISMS is the CIA triad :

C — Confidentiality

Ensures information is accessible only to authorized persons.

I — Integrity

Ensures information is accurate, complete, protected from unauthorized modification.

A — Availability

Ensures information and systems are accessible when required.

Implementing an ISMS aims to safeguard these three fundamental information security objectives.

Why the other options are incorrect:

A — This focuses only on records retention, not information security as a whole.

B — Omits integrity and availability, which are essential ISMS elements.

D — Too narrow; ISMS covers all information assets, not just customer records.

Thus, the correct answer is C , which fully represents the CIA triad.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

ISMS is responsible for protecting confidentiality, integrity, and availability of all information assets.

The CIA triad forms the basis of information security objectives.

In EPI’s project management framework, responsibility and accountability are clearly defined. While the project manager is responsible for planning, coordinating, executing, monitoring, and controlling the project, accountability for the outcome rests with the business —the entity that sponsors the project. The business initiates the project, approves its objectives, allocates resources, provides governance, and ultimately benefits from or is impacted by the results. Therefore, success or failure of the project ties directly back to the business rather than the project manager or any other stakeholder.

The project manager has operational responsibility, but the business owns the strategic outcomes, investment risks, and long-term impact. The user/customer contributes requirements and feedback but is not accountable for overall delivery. The supplier delivers contracted components or services but does not own the full project lifecycle or outcome.

EPI emphasizes that accountability must reside with the sponsoring business to avoid gaps in ownership, unclear decision-making, and governance failures. This structure ensures that the project aligns fully with organizational objectives and that decisions support long-term value.

Thus, the correct answer is C – The business .

Needs Analysis determines what the customer or business requires from a service.

This includes:

Required service hours / operating hours

Availability expectations

Business functional requirements

Legal and compliance requirements

Physical infrastructure needs (power, cooling, space)

Performance and capacity needs

Identifying operating hours is a core part of defining service requirements.

Why other options are incorrect:

B : Current resource usage is part of infrastructure assessment, not needs analysis.

C : Staffing is part of capability assessment.

D : Monitoring requirements come after service definition and design.

Thus, A is correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Needs analysis determines service operation hours, business needs, and requirements.

It precedes capability assessment and service design.

EPI’s Permit to Work (PTW) system categorizes work activities based on risk levels to ensure safe execution and hazard control within the data center.

Welding operations involve open flame, sparks, high heat, molten metal, and ignition sources , making them a high-risk activity.

In EPI safety doctrine, welding is explicitly classified under “Hot Work.”

Hot Work includes activities such as:

Welding

Cutting

Grinding

Brazing

Soldering

Flame use or spark-producing tools

Because of the fire ignition potential, a Hot Work Permit is mandatory before welding can begin.

The Hot Work PTW ensures:

Fire watch personnel are assigned

Fire suppression systems are prepared or temporarily disabled with compensating controls

Surrounding area is inspected for combustible material

Correct PPE is used

Hot-work zoning, barriers, and extinguishers are in place

Post-work monitoring is performed

Therefore, Option D (A PTW is required for hot work) is the correct and EPI-aligned answer.

EPI DCFOM-Aligned Reference Concepts

The PTW system ensures hazardous activities are controlled.

Welding is classified as Hot Work.

Hot Work requires a dedicated PTW with fire-risk mitigation and supervisory approval.

In the EPI Facilities Operations Manager body of knowledge, the Lock-Out/Tag-Out (LOTO) procedure is a mandatory safety control to ensure that electrical or mechanical equipment cannot be energized while work is being performed. A core principle emphasized in EPI safety training is:

“The person who applies the lock must be the same person who removes it.”

This aligns with international best practices for occupational health and safety, where LOTO ensures that the individual performing maintenance or repair has full control of the energy isolation device.

Why this is required:

Personal Safety Responsibility The lock identifies the technician directly working on the equipment. Only they can confirm whether work is complete and the area is safe for re-energizing.

Risk Prevention If someone else removes the lock (another operator, safety manager, or facilities manager), they may incorrectly assume that the equipment is ready to be restored, which can lead to severe injury or fatality.

Compliance With EPI Safety Guidelines EPI emphasizes the principle of “single-person control” over hazardous energy. No supervisor or colleague may remove another technician’s lock unless a formal, documented emergency override procedure is followed — which is not considered standard practice .

Clear Accountability Chain LOTO prevents ambiguity or miscommunication. The technician who placed the lock is the only one with full knowledge of the work status and hazards involved.

Why other options are incorrect:

A, B, and C violate the fundamental LOTO rule because they involve someone other than the applying operator removing the lock.

Oversight personnel (safety manager, facilities manager) monitor and audit the process, but they should not remove another person’s lock except under rare, emergency, escalation-approved situations.

EPI DCFOM-Aligned Reference Concepts

LOTO must ensure the isolation device is locked and tagged by the person performing the work.

Only the same individual may remove their own lock.

Removal by another party is only permitted under controlled, documented emergency protocols.

The process prevents accidental energization and protects worker safety.

In an RFP evaluation matrix, weight factors are applied to highlight the relative importance of each evaluation criterion.

Examples of weighted criteria include:

Technical compliance

Response time

Cost

Vendor capability

Warranty terms

SLA performance

The weight factor ensures that more critical criteria influence the final score more heavily, enabling an objective and structured vendor selection.

Why the other options are incorrect:

A : Weighting does not control prices.

C : Negotiation comes after scoring.

D : Workforce size is not the purpose of weighting.

Thus, B is correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Weighted scoring ensures high-priority criteria significantly influence vendor selection.

Supports objective and transparent procurement.

Non-renewable energy sources are those that:

Cannot be replenished within a human lifespan

Exist in finite quantities

Are extracted from fossil fuels or geological deposits

Natural gas is a fossil fuel and therefore non-renewable .

Why the other options are incorrect:

Wind energy — renewable

Tidal power — renewable

Hydropower — renewable

Thus, A is correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Sustainability planning considers renewable vs. non-renewable sources.

Natural gas is listed as a fossil fuel, hence non-renewable.

Within EPI’s Environmental Sustainability framework, the Renewable Energy Factor (REF) is the recommended metric for determining and reporting how much of a data center’s consumed power originates from renewable energy sources. REF provides a standardized, transparent, and repeatable method for calculating the renewable component of the total energy supply. This is essential because power grids draw energy from mixed sources, and data centers must demonstrate sustainability performance accurately and consistently, especially when customers demand visibility into carbon-related metrics.

Implementing REF allows the data center to quantify renewable contributions from sources such as solar, wind, hydro, geothermal, or certified renewable energy certificates. It also enables customers to compare sustainability performance across providers, improving trust and supporting corporate environmental objectives. REF becomes part of the data center’s transparency strategy, demonstrating commitment to responsible energy usage and aligning with global sustainability expectations.

Options A and B are insufficient and unprofessional; energy providers may give general data, but these are not standardized for reporting purposes. Option C is inappropriate because sustainability transparency is increasingly demanded even if not in the SLA. Therefore, implementing REF is the correct and industry-aligned response.

Qualitative risk analysis is the process of assessing risks using descriptive , non-numerical , and categorical scales to evaluate:

Probability (likelihood)

Impact (severity)

It often uses terms like:

Low / Medium / High

Minor / Moderate / Severe

Likely / Unlikely

This analysis supports prioritization, but the definition itself is about describing impact and probability , not financial quantification.

Why other options are incorrect:

A describes quantitative risk analysis (monetary values).

B is incomplete; qualitative analysis assesses both impact AND likelihood.

D is an outcome of qualitative analysis, not the definition.

Thus, C is the correct answer.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Qualitative analysis assesses likelihood and impact using descriptive scales.

Used when monetary or statistical values are not required.

EPI describes three commonly offered maintenance service levels in the data center industry:

Time & Material (T & M)

Pay per visit, per hour, and per part

No guaranteed response time

Lowest cost, lowest priority

Basic Contract

Includes scheduled preventive maintenance

Limited support for corrective issues

Faster response than T & M but still limited

Comprehensive Contract

Includes preventive + corrective maintenance

Parts + labor included

Priority response times

Best uptime protection

These are the standard, industry-recognized tiers reflected in EPI’s training.

Why the other options are incorrect:

A and B are marketing labels used in some industries but not standard for data center facility maintenance.

C is not an EPI-recognized offering.

Thus, D is correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Standard vendor offerings include T & M, Basic, and Comprehensive contracts.

Used widely for UPS, generators, cooling systems, and electrical infrastructure.