Accurate asset management relies heavily onclear, enforced proceduresfor:

Logging asset movement

Updating location records

Recording installations, removals, or relocations

Maintaining accurate configuration and asset databases

If assets are located in different places than recorded, the root cause is typically:

“Lack of procedures” or failure to follow them.

Without proper procedures:

Staff may move items without documentation.

Asset updates may not be recorded.

Inventory lists become outdated.

Tracking and audit functions fail.

Why other options are incorrect:

A: Training is important but secondary; without procedures, training has no structure.

C: Most modern asset systems can track locations; the issue is usually process-related, not system capability.

D: Financial constraints do not cause incorrect asset locations.

Thus,Bis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Asset management accuracy depends on well-defined and enforced procedures.

Incorrect asset locations typically indicate process failures, not financial or system issues.

Security incident management is a core function in maintaining physical security integrity within the data center environment. The main purpose of this process is torespond to, manage, and eliminate security breaches and vulnerabilitiesthat could compromise facility protection, customer assets, or sensitive operational areas. According to EPI’s security governance principles, a security incident may include unauthorized access attempts, misuse of credentials, badge anomalies, tailgating, tampering, suspicious activities, or procedural violations.

The security incident management process ensures that such events are logged, assessed, investigated, escalated, and resolved in a timely and structured manner. It also identifies root causes and potential systemic weaknesses that must be corrected to prevent recurrence. This includes reviewing procedures, improving physical controls, reinforcing training, and implementing corrective or preventive measures.

Option A is unrelated; guard assignment is part of staffing, not incident management. Option C refers to testing emergency plans, which is part of preparedness and exercises. Option D refers to compliance activities, but compliance is not theobjectiveof incident management—it is aresult.

Therefore, the correct answer isB – addressing breaches and weaknesses.

A compliance document register ensures that the organization maintains oversight and traceability of all documents required to meet regulatory, legal, and service-related obligations. The register is essential for audits, governance, risk management, and operational continuity. According to EPI’s GRC framework, the minimum categories that must be included arelegalandservicecompliance documents.

Legal documents include regulatory requirements, statutory obligations, contracts, permits, safety regulations, environmental compliance mandates, and jurisdictional requirements. Service documents include SLAs, OLAs, underpinning contracts, service catalogs, and operational procedures required to fulfill service commitments. These categories represent the core compliance landscape affecting the organization’s ability to operate legally and deliver services contractually.

Options B, C, and D list other organizational elements that may appear in broader documentation sets but arenot fundamental compliance categories. Marketing, budgeting, staffing policies, and business culture documents do not constitute mandatory compliance obligations and are not required for inclusion in a compliance register.

Thus, the correct answer isA – Legal and service.

The ISMS framework (aligned with ISO 27001) follows thePDCA cycle:

P – Plan

D – Do

C – Check

A – Act

This model ensures:

Continuous improvement

Systematic risk management

Documented policies and controls

Regular audits and corrective actions

Why other options are incorrect:

A – SMART: For objective setting, not ISMS.

B – PCI-DSS: A security compliance standard, not a process model.

C – ROI: A financial metric, unrelated.

Thus,Dis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

ISMS implementation is based on PDCA methodology.

Ensures continuous improvement of security controls.

When approving a new SLA (Service Level Agreement), the operations manager must verify that the organization has thecapabilityand resources to meet the service commitments defined in the SLA. Part of this verification is ensuring that the current staff mix and competency levels match the required service levels. Theskills matrixprovides a structured overview of staff roles, skill levels, competencies, and gap analysis.

Theskills matrixallows the manager to assess whether the team is capable of fulfilling the new service commitments before the SLA goes live.

Job descriptions(option B) define roles and responsibilities but do not show competency levels or gaps.

Training program overview(option A) shows what training exists but doesn’t directly show who can deliver the service now.

Resumes of staff(option D) are ad hoc and individual, not efficient for overall capability assessment.

Thus, optionC – Skills matrixis the best first reference.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Capability assessment in SLM includes reviewing skills matrices to verify workforce capability.

Before approving SLAs, organizations must ensure operational readiness and resource competence.

EPI’s governance and risk management principles clearly state:

When a data center outsources maintenance,operational work can be outsourced, but risk cannot be transferred.

Risk may beshared, mitigated, or reduced through contractual arrangements, butownership remains with the data center service provider.

The data center operator is still responsible for ensuring compliance, operational continuity, and safety—even if another party performs the maintenance tasks.

Therefore:

The service provider must remain involved in risk evaluation, risk treatment, and ongoing monitoring.

Oversight responsibilities cannot be delegated.

OptionsCandDare incorrect because outsourcing the activity doesnotoutsource risk accountability.

OptionBis irrelevant because risk responsibility does not depend on provider expertise.

Thus,Ais correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Risk ownership remains with the organization even when maintenance is outsourced.

Outsourcing shares risk but does not transfer it.

The data center must maintain involvement in the risk management process.

EPI’s safety and statutory requirements training emphasizes thatsafety is a shared responsibilityacross the entire data center organization. While roles such as the safety manager and facilities manager provide leadership, guidance, oversight, audits, and enforcement of safety procedures, they alone cannot ensure a safe workplace. Every individual working in or around the data center—whether employees, contractors, vendors, or visitors—has the responsibility to follow safety procedures, report hazards, use required protective equipment, and stop unsafe activities.

This collective responsibility approach ensures that risks are recognized early, unsafe conditions are not ignored, and safety culture is embedded throughout daily operations. The safety manager establishes policies, training, audits, and compliance frameworks; the facilities manager ensures operational processes support safety; the managing director endorses governance and resources. However,frontline workers are the most exposed to hazards, making their behavior critical.

Option C is correct because EPI emphasizes that safety cannot be delegated solely to one role; it must be embraced byall staff, ensuring a consistent, safe working environment. Data centers operate high-voltage systems, heavy equipment, and complex mechanical infrastructure, making shared vigilance essential for preventing incidents and ensuring regulatory compliance.