CDFOM Questions and Answers

In the EPI framework for risk management, after the risk identification and risk analysis steps, therisk evaluationstep determines whether the assessed risks areacceptableorrequire treatmentbased on the organization’s risk appetite, criteria, and the potential impact. The evaluation leads to a decision on whether risk treatment needs to take place.

It isnotsimply compiling all risks (so option C is incorrect).

It isnotexclusively about budgeting (so option D is incorrect) though budgeting follows treatment decisions.

It isnotnecessarily advising to accept all risks (so option B is incorrect) but rather it supports decision-making on treatment.

Therefore, option A is correct: the outcome is the decision whether to treat the risk.

EPI DCFOM-Aligned Reference Concepts (Paraphrased, Not Verbatim)

Risk evaluation assesses identified and analysed risks against risk criteria to decide on acceptability or need for treatment.

The outcome is a documented decision-making step in the risk management process.

Operational Expenditure (OPEX) includes all ongoing costs required to operate and maintain the data center on a day-to-day basis. These costs are recurring and necessary to keep the facility functioning effectively. Examples of OPEX include staffing costs, service contracts, maintenance materials, consumables, utilities, and recurring software licensing fees. Within EPI’s Facilities Management guidance, maintenance activities—such as replacing fans, belts, filters, and other wear-and-tear components—are classic OPEX items because they occur during normal operational cycles, contribute to sustaining facility uptime, and repeat regularly over the equipment lifetime.

However,acquisition of real estateis a capital-intensive investment made once during facility development and falls underCapital Expenditure (CAPEX), not OPEX. CAPEX involves large, long-term investments such as land purchase, building construction, major equipment procurement, or infrastructure upgrades. These expenditures are depreciated over years and do not represent operational overhead.

Therefore, the only option not belonging to OPEX isC – Acquisition of real estate. Staffing, maintenance material replacement, and annual software licenses are standard OPEX items essential for continuous operation, service delivery, and compliance with operational practices.

Security incident management is a core function in maintaining physical security integrity within the data center environment. The main purpose of this process is torespond to, manage, and eliminate security breaches and vulnerabilitiesthat could compromise facility protection, customer assets, or sensitive operational areas. According to EPI’s security governance principles, a security incident may include unauthorized access attempts, misuse of credentials, badge anomalies, tailgating, tampering, suspicious activities, or procedural violations.

The security incident management process ensures that such events are logged, assessed, investigated, escalated, and resolved in a timely and structured manner. It also identifies root causes and potential systemic weaknesses that must be corrected to prevent recurrence. This includes reviewing procedures, improving physical controls, reinforcing training, and implementing corrective or preventive measures.

Option A is unrelated; guard assignment is part of staffing, not incident management. Option C refers to testing emergency plans, which is part of preparedness and exercises. Option D refers to compliance activities, but compliance is not theobjectiveof incident management—it is aresult.

Therefore, the correct answer isB – addressing breaches and weaknesses.

A gap analysis aims to identify deficiencies between required capabilities and existing capabilities. When the data center manager determines that internal resources need to be offloaded, the issue relates toorganizational capability—specifically staffing levels, workload capacity, skills distribution, or the ability to sustain operational commitments. Organizational gaps occur when internal staff cannot adequately perform the required tasks due to lack of time, insufficient headcount, absence of specialized expertise, limited shift coverage, or excessive workload. In such cases, outsourcing maintenance becomes a strategic approach to stabilize operations and prevent burnout or operational risk.

This decision is not financial (Option A), because the trigger is resource relief, not budget constraints. It is not technical (Option C), which would relate to technical skills, tools, or system complexity. It is also not practical (Option D), which would indicate logistical or physical constraints. Instead, the need to offload workload is directly tied to internal organizational limitations.

Thus, the correct category isOrganizational.

Customer satisfaction surveys must be concise, relevant, and easy to complete. EPI’s service improvement guidance emphasizes that survey fatigue occurs when surveys are overly long or contain too many detailed questions, causing customers to abandon them. The most common reason for low participation isexcessive number of questions, making the survey time-consuming or overwhelming. In modern service environments, customers expect short, focused surveys that can be completed quickly. Surveys with more than a handful of core questions often have dramatically reduced response rates.

Option A (not enough questions) would not reduce participation; shorter surveys typically perform better. Option B (not sent by the data center manager) may influence perception but does not typically impact participation significantly. Option D (postal mail) is outdated but still not as strong a factor as excessive survey length—especially because the question does not indicate this method was used.

Therefore, the most likely root cause for poor participation is thatthe survey had too many questions.

EPI defines several facility options for Business Continuity:

Company-owned facility→ highest cost

Co-location→ moderate to high cost

Government-owned facility→ typically not a commercially viable or general-purpose BC option

Disaster Recovery (DR) provider→lowest-costsolution for BC

ADR provideroffers:

Shared or subscription-based DR facilities

Lower capital investment

Pay-as-you-use or retainer-based access

Rapid availability without owning infrastructure

Minimal financial burden for standby capacity

This aligns with management’s goal:cheapest possible alternative facility.

Thus,D – DR provideris correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

DR provider facilities are the most economical BC facility option.

They provide shared resources and reduce capital expenditure.

EPI’s document management methodology follows a6-step structured life cyclefor all controlled documentation used in a data center (e.g., SOPs, MOPs, EOPs, safety documents, policies, maintenance procedures).

The life cycle ensures all documents remain current, controlled, traceable, and properly retired.

Thesix recognized stagesin the EPI-aligned document management life cycle are typically:

Creation– The document is drafted and developed.

Review– Subject matter experts verify technical correctness.

Approval– Authorized managers approve it for release.

Publication / Release– Document is issued for operational use under control.

Maintenance / Updates– Regular updates and version control.

Archival / Destruction– Retired versions are archived or securely destroyed.

Within this structure,“Provisioning” isnota recognized document life-cycle stepin EPI’s DCFOM framework.

Provisioning is a term used in IT or service management (e.g., server or user provisioning) but not in document control life cycles.

Therefore,Option C (Provisioning)is the correct answer.

EPI DCFOM-Aligned Reference Concepts (Paraphrased, Not Verbatim)

Document management requires strict version control procedures.

The document life cycle includes creation, review, approval, publication, maintenance, and destruction/archival.

“Provisioning” is not part of the document lifecycle in the EPI framework.

EPI describes threecommonly offered maintenance service levelsin the data center industry:

Time & Material (T&M)

Pay per visit, per hour, and per part

No guaranteed response time

Lowest cost, lowest priority

Basic Contract

Includes scheduled preventive maintenance

Limited support for corrective issues

Faster response than T&M but still limited

Comprehensive Contract

Includes preventive + corrective maintenance

Parts + labor included

Priority response times

Best uptime protection

These are the standard, industry-recognized tiers reflected in EPI’s training.

Why the other options are incorrect:

AandBare marketing labels used in some industries but not standard for data center facility maintenance.

Cis not an EPI-recognized offering.

Thus,Dis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Standard vendor offerings include T&M, Basic, and Comprehensive contracts.

Used widely for UPS, generators, cooling systems, and electrical infrastructure.

Power Usage Effectiveness (PUE) is the most widely recognized efficiency metric in the data center industry and is strongly emphasized within EPI's environmental sustainability and energy management teachings. PUE is designed to show how efficiently a data center uses energy, focusing specifically on how much of the total facility energy actually reaches the IT equipment. The correct formula is:

PUE = Total Facility Power ÷ Total IT Equipment Power

“Total Facility Power” includes all supporting infrastructure: cooling systems, UPS losses, power distribution losses, lighting, security, fire systems, and all auxiliary loads required to operate the data center. “Total IT Equipment Power” refers only to the active IT load such as servers, storage, and network devices.

A PUE value close to1.0indicates optimum energy efficiency, meaning nearly all facility energy is being consumed directly by IT operations. Higher PUE values indicate less efficient facilities where substantial energy is being consumed by overhead systems. This metric is essential for sustainability strategies, capacity planning, and continuous improvement. It allows benchmarking across facilities and helps operators set improvement targets by analyzing where energy losses occur. Because of its simplicity and clarity, PUE remains an industry-standard metric recognized globally.

When operators receive excessivenon-alarm notifications, this indicates that:

Thresholds are not well-configured

Events are misclassified

Alarm definitions are incorrect

Monitoring profiles require tuning

EPI’s monitoring best practices state that the correct response is to:

Review alarm information and adjust definitions, thresholds, and filtering.

This ensures that:

Only relevant alarms reach operators

Noise is minimized

Operators maintain focus on true issues

SLA-related metrics are accurately monitored

Why other options are incorrect:

A: Training is secondary and will not fix incorrect alarm settings.

C: Ignoring notifications is dangerous and violates operational control.

D: Upgrading software may not resolve the underlying configuration problem.

Thus,Bis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Monitoring systems must generate actionable alarms, not noise.

Alarm thresholds and event filters must be reviewed and optimized regularly.

When customers are billed based on the actual consumption of services, this model is known asMeasured Resource Usage (MRU).

MRU charges customers according to:

Actual power consumption

Actual cooling usage

Actual rack utilization

Actual bandwidth or cross-connect usage

Actual resource usage metrics

This model aligns with transparency, fairness, and resource accountability.

Why other options are incorrect:

A – SBP: Charges based on predefined service definitions, not usage.

B – NFR: A single negotiated flat fee, regardless of usage.

C – TFR: Flat fee bands or tiers, independent of precise usage.

Thus,D – MRUis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

MRU charges customers based on actual measured resource consumption.

Common in modern colocations to align costs with usage.

EPI distinguishes between:

Service Portfolio→ internal document used for service design, planning, assessment

Service Catalog→ customer-facing document listing available services

Theservice catalogprovides customers with:

Service descriptions

Service options

Ordering information

Terms and conditions

SLA details

Pricing models (where applicable)

It is specifically designed to allow customers to select and order services.

Why other options are incorrect:

A: Service portfolio is internal only.

B: BCP is unrelated to service ordering.

C: Needs analysis is internal planning documentation.

Thus,Dis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

The service catalog contains all customer-orderable services.

It is the primary communication tool for customer consumption.

EPI’s governance and risk management principles clearly state:

When a data center outsources maintenance,operational work can be outsourced, but risk cannot be transferred.

Risk may beshared, mitigated, or reduced through contractual arrangements, butownership remains with the data center service provider.

The data center operator is still responsible for ensuring compliance, operational continuity, and safety—even if another party performs the maintenance tasks.

Therefore:

The service provider must remain involved in risk evaluation, risk treatment, and ongoing monitoring.

Oversight responsibilities cannot be delegated.

OptionsCandDare incorrect because outsourcing the activity doesnotoutsource risk accountability.

OptionBis irrelevant because risk responsibility does not depend on provider expertise.

Thus,Ais correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

Risk ownership remains with the organization even when maintenance is outsourced.

Outsourcing shares risk but does not transfer it.

The data center must maintain involvement in the risk management process.