Safety Norms: Cloud Computing and DevOps Engineering

1Purpose, Scope, and Safety Principles

These norms set out how cloud computing and DevOps engineers prevent harm while designing, deploying, and operating systems. Harm in this field is not limited to physical injury. A misconfigured storage bucket can expose personal data, a faulty deployment can disrupt emergency services, and an unsafe on-site change can injure staff or damage equipment. The norms apply to anyone who builds infrastructure as code, manages cloud accounts, maintains continuous integration and delivery pipelines, operates monitoring, or works in a server room or data center.

Three principles guide the rest of the document: least privilege, reversible change, and safe failure. Access is granted only as needed, changes are staged and can be rolled back, and systems are designed to degrade safely rather than expose data or people.

• Mandatory: no one performs production changes without an approved change record or an approved emergency procedure.
• Mandatory: no one works on energized or unfamiliar on-site equipment without authorization and the local lockout procedure.
• Recommended: treat every new tool or service as a hazard until its data flows, permissions, and failure modes are understood.

2Roles, Competence, and Accountability

The service owner is accountable for the safety of a system throughout its life, including its access model, data classification, and recovery targets. The change manager or designated approver reviews production changes. The platform or DevOps lead maintains pipelines, templates, and guardrails. The facilities or data center manager controls physical access, power, cooling, and fire systems at any on-site location. Each role must be named in the local documentation.

Competence is demonstrated, not assumed. Engineers may hold vendor or internal qualifications, but those credentials are not proof of authorization to work on specific systems. Authorization comes from the system owner and, for on-site work, from the facility manager. Your organization's approved procedures and qualified supervisors determine which tasks require direct supervision.

• Mandatory: grant production and privileged access only after documented training and written approval from the system owner.
• Mandatory: on-site electrical, battery, lifting, and hot-work tasks require authorization from the facility manager and qualified personnel.
• Recommended: pair newer engineers with an experienced owner for their first production deployment and their first rack-level task.
• Recommended: review every privileged role at least every three months and remove access that is no longer needed.

3Hazards and Risk Assessment

Begin with a short risk assessment for each system and each recurring task. Record the activity, the people involved, the assets affected, the likely harm, and the control. Rate risk as low, medium, or high using likelihood and severity, and escalate any high rating before work proceeds. Identify where people are exposed: remote operators on call, staff in data halls, vendors, and the public who rely on services.

Hazards fall into five groups. Physical hazards include electrical energy, stored battery energy, heavy racks, moving fans, raised floors, and cable trays. Information hazards include exposed secrets, personal data, and misdirected logs. Operational hazards include unreviewed deployments, configuration drift, and capacity exhaustion. Human factors include fatigue during on-call shifts, time pressure, and interrupted work. Environmental hazards include energy use, cooling demand, electronic waste, and battery disposal.

• Electrical: power distribution units, uninterruptible power supplies, and lithium battery systems can deliver lethal or fire-causing energy. Rate as high risk and do not open enclosures without authorization.
• Credentials: API keys, passwords, and tokens committed to repositories, pasted into tickets, or printed on labels are high risk and must be rotated immediately upon exposure.
• Deployments: a change to shared infrastructure, such as a network route or identity policy, can affect many services at once. Rate as high unless it has been tested in a non-production environment with a tested rollback.
• Fatigue: engineers working long on-call periods may make errors. Apply the approved shift limits and hand off clearly.
• Data exposure: logs, backups, and test datasets may contain personal or regulated data. Apply classification before copying.
• Environmental: decommissioned hardware and batteries require authorized recycling or disposal through approved channels.

4Preventive Controls and Safe Delivery Practices

Controls work best in layers. Prefer elimination and substitution first: use managed services where they meet requirements, and use infrastructure as code so that configurations are reviewed rather than edited by hand. Engineering controls include guardrails, policy-as-code checks, network segmentation, and automatic encryption. Administrative controls include change approval, peer review, and runbooks. Personal controls, such as protective equipment, come last.

Safe delivery requires every change to pass through a defined pipeline. Code is peer reviewed, tests run automatically, security scans are required before release, and production deployments use staged rollout with health checks. Each deployment has a named owner and a rollback plan that has been tested. Feature flags allow risky functionality to be disabled without redeployment.

• Mandatory: production changes are made through version-controlled code and the approved pipeline, not by manual console edits, except under the emergency procedure in the incident section.
• Mandatory: no secret values are stored in source code, container images, tickets, or chat. Use the approved secrets manager.
• Mandatory: multi-factor authentication is required for all administrative cloud and repository accounts.
• Mandatory: change freezes apply during agreed peak business periods and before major public events, as set by the service owner.
• Mandatory: lifting equipment over the manufacturer's stated limit, or without mechanical aid where required, is prohibited. Use two-person handling or a lift as specified in the manufacturer's instructions.
• Mandatory: a permit to work is required for hot work, roof or raised-floor work, and any task in a restricted zone.
• Mandatory for energized equipment: follow the approved lockout and tagout procedure, confirm zero energy state with an approved tester, and never work alone.
• Recommended: deploy first to a small canary group, watch error rates and latency for a defined period, and then continue rollout.
• Recommended: write runbooks with exact commands, expected output, and clear stop conditions.

5Facilities, Equipment, Information, and Protective Safeguards

Physical safeguards protect staff and equipment in server rooms and data centers. Access is restricted by badge or key, logged, and reviewed. Visitors are escorted. Cable routing must not block exits, emergency equipment, or airflow paths. Tools must be insulated where rated for the task, and electrostatic discharge controls such as wrist straps are used when handling bare boards. Food and drink are kept away from live equipment.

Personal protective equipment (PPE) is required by the facility's risk assessment, not by habit. Typical examples include safety footwear, electrically rated gloves where the electrical risk assessment requires them, eye protection when cutting cable ties or handling batteries, and hearing protection in high-noise areas. Confirm PPE ratings with the manufacturer and the local safety officer.

Information safeguards apply the same rigor to data as to hardware. Classify data, restrict copies, encrypt in transit and at rest, and avoid using production personal data in development. Lock sessions when leaving a desk and avoid unmanaged networks for administrative sessions. Regulated categories, such as health, financial, or children's data, carry additional rules that must be verified with your privacy and compliance team and the applicable authorities.

• Mandatory: restricted areas remain locked, and tailgating through access doors is prohibited.
• Mandatory: lithium battery storage and charging areas must follow the manufacturer's instructions and local fire rules, as verified by the facility manager.
• Mandatory: fire suppression systems must not be disabled, blocked, or tested without written approval from the facility manager.
• Mandatory: personal data must not be placed in tickets, public repositories, or test fixtures unless it has been anonymized under approved methods.
• Recommended: label circuits and equipment clearly and keep an updated asset inventory showing location and power draw.
• Recommended: monitor energy use and cooling efficiency with facilities, and remove idle instances and unused storage to reduce waste and cost.

6Incident, Emergency, and Escalation Procedures

Any incident affecting availability, confidentiality, integrity, or physical safety is reported immediately to the on-call lead and the security contact. Near misses are reported too, because they reveal weak controls before harm occurs. Do not delay reporting to investigate alone. Preserve evidence such as logs and configuration snapshots, and avoid deleting artifacts during a live response.

For physical emergencies, the first priority is life safety. Evacuate on the alarm, call local emergency services using the facility's approved method, and do not re-enter until cleared. Do not attempt to fight electrical or battery fires beyond the training and equipment provided. Report the location, hazard, and people involved. A suspected data breach triggers the organization's notification process. Legal notification duties depend on jurisdiction and data type, so confirm them with counsel and the privacy officer.

• Mandatory: report suspected security incidents within the timeframe set by the organization's incident policy, and do not discuss external disclosure without authorization.
• Mandatory: if a change causes harm, roll back or disable the feature first, then investigate.
• Mandatory: during an electrical or battery fire, do not use water-based extinguishers on energized equipment unless the manufacturer and local fire procedure allow it.
• Mandatory: avoid heroic fixes during fatigue. Hand off to a second engineer when shift length approaches the approved limit.
• Recommended: hold blameless post-incident reviews within a set period and assign tracked corrective actions.

7Records, Training, Monitoring, and Review

Records make safety verifiable. Keep change records, approval evidence, risk assessments, access reviews, permits to work, maintenance logs, training records, and incident reports. Retention periods depend on the organization's policy and applicable law, which must be verified locally. Store records in a controlled system with restricted access.

Training is refreshed when tools, systems, or procedures change, and at intervals set by the organization. Monitoring includes alert quality, deployment failure rates, access anomalies, battery and temperature alarms, and overdue patching. Review these norms at least annually and after any significant incident, and record each improvement.

• Mandatory: maintain an access review record showing who approved each privileged role and when access was last confirmed.
• Mandatory: inspect on-site racks, battery systems, and fire detection on the schedule set by the facility manager, and record the results.
• Recommended: track deployment frequency, change failure rate, and mean time to restore as delivery health indicators.
• Recommended: run tabletop exercises for outage, breach, and power loss scenarios, then update runbooks from the findings.

Implementation checklist

• Confirm your role, authorization, and training record before any production or on-site work.
• Use the approved pipeline and a tested rollback plan for every change.
• Store no secrets in code, tickets, images, or chat, and rotate any exposed credential immediately.
• Check data classification before copying data into test or analytics environments.
• Obtain a permit and follow lockout procedures before touching energized equipment.
• Confirm PPE requirements with the local safety officer for each on-site task.
• Report incidents and near misses immediately to the on-call lead and security contact.
• Hand off clearly when on-call shifts approach the approved limit.
• Review privileged access at the required interval and remove unneeded rights.
• Dispose of hardware and batteries only through authorized recyclers or approved channels.