Safety Norms: Information Technology and Digital Consulting

1Purpose, Scope, and Safety Principles

These norms set minimum expectations for anyone who performs information technology and digital consulting work, including advisors, architects, systems engineers, project managers, data specialists, and contractors working in offices, data centers, client facilities, remote locations, or home offices. Their purpose is to protect people from physical and psychological harm, protect client and personal information from unauthorized access, and keep digital services reliable when they affect health, safety, finances, or public services.

Three principles guide every norm. First, a rule is mandatory when it is marked must and is backed by a legal requirement, contract term, or approved company policy. A recommendation is marked should and represents good practice that local management may adapt. Second, no task proceeds when the responsible person is unsure it is safe, lawful, or authorized. Third, every system change is treated as a potential source of harm until its impact is understood.

2Roles, Competence, and Accountability

The engagement lead owns the safety and compliance plan for each project and confirms that scope, client obligations, and access arrangements are documented before work begins. Practitioners must work within their authorization and stop when a task exceeds their training. Competence must be shown, not assumed.

Work on high-voltage equipment, uninterruptible power supplies, battery systems, and raised floors is restricted to qualified personnel. Where a trade qualification or license is required by local law, the organization must verify it and keep a copy on file.

• Engagement lead: approves the statement of work, data handling terms, and safety plan before access is granted.
• Technical lead: approves change plans, test results, and rollback steps for any work on production systems.
• Facilities contact: authorizes entry to data rooms, electrical panels, roof access, and lifting work.
• Security officer: approves privileged account use, third-party connections, and data transfers.
• Each practitioner: completes required training, reports hazards, and refuses tasks outside authorization.

3Course-Specific Hazards and Risk Assessment

Realistic hazards in this subject fall into five groups: physical, electrical, ergonomic, information, and decision-related. Physical hazards include slips and falls from ladders or step stools during rack work, pinch points from rails and doors, and heavy equipment such as servers, UPS units, and battery cabinets. Electrical hazards include contact with live power distribution, arc flash in switchgear, and stored energy in capacitors and batteries.

Ergonomic and psychological hazards arise from long periods at screens, repetitive keyboard use, poor home workstation setup, travel fatigue, and pressure during outages or migrations. Information hazards include disclosure of personal or confidential data, malware from unverified downloads, misconfigured cloud storage, and credentials exposed in code or chat. Decision hazards include deploying untested changes and relying on automated outputs without verification.

• High: energized electrical work, battery handling, and switchgear access. Restricted to qualified staff.
• High: production changes without a tested rollback during live service.
• Medium: lifting racks or equipment without mechanical aids or a second person.
• Medium: handling client personal data on unmanaged devices.
• Low to medium: prolonged screen use without a workstation review.

4Preventive Controls and Safe Work Practices

Controls are applied in order of effectiveness: remove the hazard where possible, isolate it, engineer a safeguard, use administrative controls such as approvals and checklists, and only then rely on personal equipment. For example, a consultant must not modify a charger or power cable to fit a server room outlet. The approved fix is a supplied cable that meets the manufacturer's listed requirements. Manufacturer instructions and local electrical codes must be checked for every device.

Safe practices include named accounts with least privilege, separate administrative and daily accounts, secrets stored in an approved vault, and written client approval before running scans, penetration tests, or data migration jobs. Automated tools and AI-generated outputs must be reviewed by a qualified person before they inform decisions or touch live systems. Work stops if an unexpected result could cause data loss, service disruption, or exposure.

• Must: obtain written change approval before modifying any production system, network device, or data store.
• Must: test changes in a non-production environment and document a tested rollback method before deployment.
• Must: agree a maintenance window and change freeze with the client before live work begins.
• Must: never work on energized power equipment, UPS batteries, or switchgear unless qualified and authorized under the site procedure.
• Must: use two people and mechanical aids for lifting above the limit set by the organization's manual handling procedure.
• Must: remove power and verify zero voltage with a tested meter before opening any enclosure with power feeds.
• Should: label and manage cables to prevent trip hazards and accidental disconnection.
• Should: keep aisles and access routes clear of cables, boxes, and tools.

5Equipment, Environment, Information, and Protective Safeguards

Equipment must be fit for purpose and maintained. Laptops and test devices should carry current operating system updates, endpoint protection, encryption, and automatic screen lock. Lithium battery packs and portable power banks must be used and stored according to manufacturer instructions and local fire rules. Damaged cables, swollen batteries, or burning smells mean the device is removed from use and reported.

Information safeguards apply to all data, not only regulated data. Practitioners collect only what the engagement requires, mask or anonymize test data, and never copy production records to personal devices. Privacy duties depend on jurisdiction and contract, so the security officer must confirm applicable laws and record the lawful basis for processing.

• Must: encrypt laptops and removable media holding client information using the approved method.
• Must: use only approved removable media, scanned before use. Never plug in unknown USB devices.
• Must: report smoke, water leaks, or cooling alarms immediately. Do not fight fires unless trained and the procedure allows it.
• Should: keep room temperature and humidity within the equipment manufacturer's stated range.
• Should: set workstations with the screen at eye level, an adjustable chair, and scheduled breaks, including for home workers.
• Must: wear eye protection and protective footwear where the site requires them for cabling or facility work.

6Incident Reporting, Emergency Response, and Escalation

An incident is any event that caused or could have caused harm, including injury, electric shock, fire, data exposure, ransomware activity, lost backups, or unauthorized access. A near miss is an event that caused no harm but revealed a weakness, such as a tool left beside energized equipment or a phishing message that nearly captured credentials. Report injuries, fire, electrical contact, and suspected breaches immediately. Report all other incidents and near misses within the period the organization sets.

Escalation follows the incident response and business continuity plans. Consultants do not contact regulators, media, or insurers on their own authority. Emergency contacts, evacuation routes, fire equipment, and emergency power off locations must be known before work starts at each site.

• Must: call local emergency services for injury needing urgent care, fire, electrical contact, or a person trapped near machinery. Only trained persons give first aid.
• Must: isolate a compromised device only as the incident response plan directs, to preserve evidence.
• Must: notify the security officer and engagement lead of any suspected personal data breach so legal duties can be assessed.
• Should: record times, people, systems, and actions while details are fresh.

7Records, Training, Inspection, and Review

Records make safety verifiable. The organization keeps current risk assessments, change approvals, rollback plans, access logs, training records, inspection records, incident reports, and data handling decisions. Retention periods are set by contract and applicable law, which vary by jurisdiction and must be verified with a legal advisor.

Monitoring uses leading indicators such as overdue patches, unmanaged devices, failed changes, near-miss reports, and training completion, as well as lagging indicators such as injuries and breaches. Reviews occur after each project phase and after every significant incident, and lessons update this document and local procedures.

• Must: complete induction on site safety, emergency arrangements, and information handling before first access.
• Must: complete refresher training when a law, standard, client requirement, or tool changes.
• Must: review client system access when staff change roles or leave the project.
• Should: run tabletop exercises for ransomware, power failure, and data breach at a frequency set by management.

8Legal Compliance and Verification

Laws, standards, and codes that apply to IT and digital consulting vary by jurisdiction and sector. They may include occupational safety rules, electrical installation codes, fire codes, data protection statutes, sector rules for health, finance, or public services, export controls, and contractual security terms. This document does not state legal requirements. Practitioners must verify current versions with competent authorities, the client legal team, or qualified professionals.

This is educational guidance. It does not replace professional authorization, formal training, approved company procedures, supervision, or emergency services. Work in regulated environments such as healthcare systems, critical infrastructure, payment systems, and industrial control networks requires specialist review before any change is made.

Implementation checklist

• Confirm written scope, data handling terms, and access approval before starting work.
• Verify a change approval and tested rollback plan exist for every production change.
• Check that anyone performing restricted or energized work holds current authorization.
• Isolate and verify zero voltage before opening power equipment, following the site procedure.
• Use two people and mechanical aids for heavy lifts and rack work.
• Confirm laptops and removable media are encrypted and that no unknown USB devices are used.
• Keep cables managed, aisles clear, and fire equipment and exits unobstructed.
• Report injuries, fire, electrical contact, suspected breaches, and near misses within the required time.
• Confirm emergency contacts, evacuation routes, and emergency power off locations at each site.
• Record decisions, test results, and training completion in the approved log.
• Verify applicable laws, standards, and manufacturer instructions with competent authorities or qualified professionals.