Tier III and PCI DSS claims in a 6 MW colocation audit
A colocation provider markets a 6 MW hall as 'Tier III, fully concurrently maintainable'. The topology has 2N UPS and dual-corded customer racks, but cooling is N+1 CRAH units on a single chilled-water distribution loop with manual isolation valves; taking a CRAH out for maintenance requires local isolation, not concurrent maintenance of the loop. A PCI DSS assessor finds that generator and CRAH maintenance occurs inside the cardholder data environment without documented change control, and CCTV video is retained only 21 days. Sales has signed a contract with a financial customer requiring 'Tier III certification' and 'PCI DSS compliant physical security'. The renewal audit is in 10 weeks. The operations director wants to issue a customer letter saying all findings are closed. Engineering says the cooling fix needs a six-month project and a four-hour cooling outage. No certification body report is in the file.
1. How should the provider respond to the customer contract and to the operations director's proposed letter? Address the Tier III and PCI DSS claims separately.
Read the worked answer
Do not send a letter saying all findings are closed. The Tier III claim is not supported by a certification report and the cooling loop lacks concurrent maintainability. The honest position is: 'The hall is designed with 2N UPS and dual-corded racks; cooling is N+1 but the distribution loop is not concurrently maintainable. A remediation project is underway. We do not represent the facility as Tier III certified.' If the contract requires certification, legal and the customer must agree a remediation plan or a service credit; a unilateral letter creates misrepresentation risk. For PCI DSS, compliance is an assessment result, not a certificate; the provider should give the assessor's report or AOC scope. The 21-day CCTV retention and maintenance inside the CDE are findings that need evidence, not a closing letter. The operations director can close only findings with verified evidence and a change record. The customer letter should disclose the cooling limitation and the audit status, with a dated remediation plan and a named contact.
2. Propose a remediation roadmap for the cooling topology and the audit, with sequencing and interim controls.
Read the worked answer
First, verify the actual failure modes: can a CRAH be isolated without affecting the loop? If not, the design is not concurrently maintainable. Interim: restrict new high-density commitments, add temporary monitoring, pre-stage hoses and valves, and schedule maintenance only in approved windows with customer notification. Remediation: install isolation valves and a dual-header or ring distribution so one CRAH and one loop segment can be maintained without shutting the hall; this is a six-month project, so do not promise Tier III before commissioning. Sequence: design review and hydraulic model; valve/header installation during a planned 4-hour outage with load on UPS and temporary cooling; commissioning with one CRAH out; update as-built and certification evidence. Audit: separate PCI DSS physical-security findings from the Tier claim; fix change control and CCTV retention to at least the assessor's required period, collect evidence, and book a follow-up assessment. Do not combine the customer letter with the audit closure.
3. What should sales tell the financial customer now, and what contractual terms would you insist on?
Read the worked answer
Sales should say: the facility has dual UPS paths and dual-corded racks; the cooling distribution is being upgraded to concurrent maintainability; full Tier III certification is not currently evidenced; PCI DSS status is subject to assessment, with two physical-security findings under remediation. Do not use 'Tier III certified' in the proposal. Contract terms: a defined availability commitment with measurement points and exclusions; a remediation milestone schedule; service credits for missed certification or audit dates; customer right to audit or receive assessor reports; no representation that certification exists until the certificate is issued. If the customer requires Tier III as a condition precedent, structure it as a condition subsequent with a cure period, or price the risk. Also require change control for any maintenance in the customer's CDE and a CCTV retention commitment that meets the assessor's finding. This protects the provider from misrepresentation while giving the customer a credible path.