Data Centre Standards, Compliance and Audit
This domain tests whether you can name the right standard for a claim, distinguish a design rating from a management-system certification, and describe how an audit produces findings.
The standards landscape
- ANSI/TIA-942 - data centre telecommunications infrastructure, with design ratings Rated-1 to Rated-4.
- ISO/IEC 22237 series - data centre facilities and infrastructures, developed alongside the European EN 50600 series, which uses availability classes 1 to 4.
- Uptime Institute Tier Standard - Topology (Tier I–IV) and Operational Sustainability.
- BICSI 002 - data centre design and implementation practice.
- Management-system standards: ISO/IEC 27001 (information security), ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (occupational health and safety), ISO 50001 (energy), ISO 22301 (business continuity).
- Industry schemes: PCI DSS, SOC 2, HIPAA, GDPR.
Compliance, conformance and audit
"Shall" is a requirement; "should" is a recommendation. An audit has a scope, criteria and evidence, and is first-party (internal), second-party (customer or supplier) or third-party (independent). Certification bodies are accredited to ISO/IEC 17021, testing laboratories to ISO/IEC 17025, inspection bodies to ISO/IEC 17020. Findings are graded: major nonconformity (system failure or unaddressed requirement), minor nonconformity (isolated lapse), observation and opportunity for improvement. Certification is a point-in-time judgement maintained by surveillance audits and periodic recertification, not a permanent state.
Worked example
An operator advertises "TIA-942 Rated-4 certified". Reason it through: Rated-4 is a TIA-942 topology rating implying fault tolerance, and it is not interchangeable with Uptime Institute Tier IV, even though both require fault tolerance. The claim also says nothing about ISO/IEC 27001 certification of the operator's security management system, and nothing about operational performance. A correct answer asks four questions: which scheme, which edition, which scope (building, suite or tenancy) and which accredited body issued it.
Traps that cost marks
- Treating Tier IV and Rated-4 as synonyms, or converting one into the other.
- Calling a SOC 2 report a certificate.
- Confusing ISO 9001 with ISO/IEC 27001.
- Accepting "we comply with TIA-942" without a stated rating and scope.
- Mixing accreditation (the body) with certification (the organisation).