Surely this would come from a fire risk assessment and also your business continuity plans.

Hi DF2, I think the best way to reach a decision on whether the fire suppression is really needed is to fully consider all aspects of the risk e.g.
the likelihood of ignition
the likelihood of spread
the extent of damage that would be caused
the criticality of the systems
the availability of replacement kit
the down time before critical parts are restarted
the overall impact to the business from the scenario
the possibility of contingency arrangements
the appetite for risk of the business
the acceptability or otherwise of that risk.

If the answer at the bottom reached by the business owners is to accept the lack of suppression then that is their decision to make.

Lack of email and accounts for a few days will be unlikely to kill a business but denial of service to volatile customers may be too much of an exposure.

Dave makes some very valid observations, especially that of the appetite for risk. For the most organisations it is not the cost of the equipment that is the biggest concern (especially if this is insured) but rather the value of the data and the time taken to restore that data and the potential of loss of business while that data is being restored (if at all).

This may not be an insurable/insured risk (and therefore of no great concern to your insurers) but for your organisation itself, I would have thought that this should be one of the major considerations especially as any significant delay is being able to restore data could be the difference between being able to sustain a viable business or not.

If you are doing regular backups to another location (real or virtual) and you have a robust recovery plan, then your organisation might consider that sufficient.

I you have raised this at the correct level and they chose to ignore the advice that they pay you for then I am not sure if you need to keep battling against them unless you feel that there is a significant life risk; even then like most of us, if you have raised the issue at the correct level and with plausible arguments, then you have probably done all you can do. You don't have to win every 'battle'.

Cost (alongside the risk, the appetite for risk etc etc) is valid.

Firstly to those who think a FRA will provide any useful information to assess whether or not to provide a suppression system in this case, of course it wont. FRAs consider life risk and not asset protection.

I must come clean and admit I dislike posts that simply refer people to a British standard, but in this case I will do the same. The bottom line is you simply must align your risk assessment to a proper standard to get best practice and de-personalise the decision

BS6266:2011 is £200, but worth every penny when assessing data hall/server room fire protection.

It defines various sizes of risk into (I think) 4 groups - from a server room to a top tier data hall. then it gives guidance on each group how and to what level the kit should be protected.

Take care if you are going with the "do nothing" option, as you need to base that on a proper standard, rather that discussing it over a pint in the pub. So, if it all goes belly up and the same Directors who didnt want to spend any cash come looking for a fall guy, you can link your RA with the model as set out in BS6266 and prove due diligence

I am currently involved in an identical situation at a major multi £million site. I have got all parties to agree that the BS 6266 methodology is the one we will use to ensure our final decision is linked to best practice.

Its all about being able to sleep at night. Surely that's worth £200 of anyone's money!!

http://shop.bsigroup.com.../?pid=000000000030189448