SANS 246 OR NOT ?
Since the introduction of the update to SANS 246 in 2015 there seems to be confusion in the industry as to where this standard gets used.
The earlier edition of SANS 246 applied to ALL electronic environments but due to the much stricter requirements for larger more critical electronic areas the latest standard removed references to environments that were categorised slight or low risk.
This means small to medium business IT rooms, commercial departments and call centre facilities. These should use the requirements of SANS 14520, SANS 369 and SANS 10139.
SANS 246 should be used when dealing with IT environments categorised Medium, High or Critical risks. These are typified by having dedicated equipment rooms and centralised server/computer facilities such as main IT computer facility, major telecommunication facilities, production control computers all the way through to air traffic control facilities.SANS 246