What does server operations include? A checklist for companies

Server operations is ongoing work, not a one-off setup. There are seven areas worth holding your operator to: updates and security patches, backups and restore tests, monitoring, troubleshooting, access management, logging and documentation.

The list draws on ENISA's guide for SMEs, EU law and international security frameworks. At the end you will find questions worth putting to your server operator.

Updates and security patches

NIST SP 800-40 Rev. 4 frames patching as a critical part of preventive maintenance and a cost of doing business. It has five steps: identifying, prioritizing, acquiring and installing patches, then verifying the installation.

ENISA's SME guide asks for regular updates to all software, with automatic updates switched on where possible. It also asks you to identify the software and hardware that need manual updates.

Check: is there a list of the software running on the server, who decides which patch goes on when, and does anyone verify afterwards that the installation worked?

Backups and restore tests

ENISA gives four rules for backups. They should be regular and automated where possible, stored separately from the production environment, and encrypted, especially when moved between locations. The ability to restore should be tested regularly, ideally a full restore from start to finish.

The UK NCSC asks the same: know how to restore your backup, and check that it contains all your important data.

If the server handles personal data, Article 32 of the GDPR lists, among the appropriate measures, the ability to restore data in a timely manner after an incident. It also mentions a process for regularly testing the effectiveness of the measures.

Monitoring

ENISA suggests considering tools that monitor your systems and raise an alert on suspicious activity or a security breach. For remote access it specifically asks for monitoring and alerting to be switched on.

Check: what exactly the monitoring watches, who receives the alerts, and what happens outside working hours or at the weekend.

Troubleshooting and incident response

ENISA recommends a formal, documented incident response plan with clear guidelines, roles and responsibilities, so that every security incident gets a timely and professional response.

CIS Control 17 describes the same as a program: policies, plans, procedures, defined roles, training and communications for responding quickly.

Check: is it written down who does what during an outage, who must be notified, and when to restore from backup?

Access management

CIS Control 6 says access should be created, assigned, managed and revoked, for user, administrator and service accounts alike.

ENISA asks for unique, unshared passwords, a password manager and multi-factor authentication. It would limit remote access to the systems people need for their work, and restrict logins from suspicious geographic locations or certain IP addresses.

Check: is there a shared administrator account, and how long does it take for a departing employee or former supplier to lose access?

Logging

CIS Control 8 asks you to collect, alert on, review and retain the logs that could help detect, understand or recover from an attack.

According to the draft of NIST SP 800-92 Rev. 1, log management means generating, transmitting, storing, accessing and disposing of log data. It also supports investigating incidents, finding operational issues and meeting retention requirements.

Check: which logs are kept, for how long, and whether anyone reviews them regularly.

Documentation

CIS Control 1 asks for an inventory of all assets, including those in the cloud, so you know exactly what needs to be monitored and protected.

Good documentation is useful because someone else can pick it up. If your operator dropped out tomorrow, someone would need to carry on from the written record.

Check: do you have the asset list, the list of access rights, the backup schedule and the restore steps, and when were they last updated?

Who has to do all this?

Under Article 21 of the NIS2 Directive, Member States must ensure that essential and important entities take risk management measures, so companies are bound through national transposition. The measures include incident handling, backup management and disaster recovery, vulnerability handling, access control and, where appropriate, multi-factor authentication.

If your company is not one of them, the list is still a good benchmark.

If your operator processes personal data on your behalf as a processor, Article 28 of the GDPR requires a contract stating that it takes the security measures required by Article 32.

Questions for your server operator

1. How and how often are security patches applied, and who verifies the installation?
2. Where is the backup, and is it kept separate and encrypted? When was the last restore test, and what was the result?
3. What does the monitoring watch, and who receives alerts outside working hours?
4. Is there a documented incident response plan with named owners?
5. Who has access to the server, is there multi-factor authentication, and how do you revoke access?
6. Which logs do you keep, for how long, and who reviews them?
7. Do we get the documentation, and could another operator take over the system from it?
8. For personal data: is there a processing agreement under Article 28 of the GDPR?

Next steps

If you are still deciding whether the system should run on your own server or in the cloud, our comparison of on-premise and cloud covers it.

If you are looking for an operator, see our server operations page.

Sources

• ENISA: Cybersecurity guide for SMEs, 12 steps to securing your business (Hungarian edition, PDF)
• NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning (April 2022)
• NCSC: Small organisations guide to cyber security, Backing up your data
• Regulation (EU) 2016/679 (GDPR), Articles 28 and 32
• Directive (EU) 2022/2555 (NIS2), Article 21
• CIS Critical Security Controls: list of the 18 controls (Controls 1, 6, 8, 17)
• CIS Control 8: Audit Log Management
• NIST SP 800-92 Rev. 1: Cybersecurity Log Management Planning Guide (initial public draft, October 2023)