Data center certifications in the service of trust and attractiveness

As the true backbone of the information system, data centers must above all guarantee the highest levels of availability to stakeholders. Indeed, in the event of a service interruption following an outage, indirect costs (costs related to the unavailability of hosted applications) far exceed direct costs (repair, restoration of service). Outages can have several causes: a design flaw or equipment failure, human error, a cyber-attack or a malicious act. To prevent potential outages, it is therefore essential to have a global view of the risks associated with the operational management of data centers.

At the same time, the issue of environmental and energy performance has become a major concern for organisations, both for economic and ecological reasons. Indeed, energy expenditure represents around 50% of the total cost of ownership of data center infrastructure. Moreover, societal expectations are increasingly strong, so companies are now seeking to reduce the environmental footprint of their data centers.

To implement best practices in terms of service continuity, security or environmental performance, there are a number of frameworks to draw on. These standards may be generic and applicable to data centers, such as ISO standards (14001, 50001, 27001), or specific to data centers (Uptime Institute, Code of Conduct, etc.), or even specific to certain activities and hosted data (HDS for health data, PCI-DSS for banking data, etc.).

These various standards are mainly used as best-practice guides for designing, building and operating data centers. They also help to structure activities and establish a dynamic of continuous improvement and risk management. However, only certification, which is issued by independent experts, provides the assurance that all the requirements of the frameworks are actually being met.

In France, historically, only very large hosting providers embarked on certification programmes. But today, to meet market requirements and stakeholder expectations, this type of project is extending to all types of players (public, private) or hosting (colocation, in-house, cloud) and concerns data centers of all sizes. While, for data centers hosting health or banking data, HDS or PCI-DSS certifications are respectively mandatory, in other sectors the choice of certifications may be broader and vary according to the challenges and objectives of each company: operational excellence, differentiation from the competition, or enhancing image, attractiveness or extra-financial performance. Certifications then provide tangible arguments that can be highlighted to attract new customers or talent, and even investors.

However, a trend is emerging, particularly among digital players: they have realised that there can be no compromise between operational excellence, information system security and environmental performance. This is why the trend is towards multi-certification and the implementation of integrated management systems enabling all topics to be managed jointly.

As most players already rely on the frameworks, obtaining one or more certifications can be achieved within an average timeframe of between 8 and 12 months. In addition, investment in such an approach may benefit from ADEME incentive schemes, for example with regard to environmental certifications.

In any case, it is certain that technological, political and societal developments will have an impact on the requirements defined in certification frameworks, with the latter providing reassurance of the expectations of all stakeholders, at all levels. Whether the choice is made to certify or not, the aim now is to initiate excellence approaches in all three areas in parallel: service continuity, security and environmental performance.

By Caroline Vateau, Director of the Sustainable IT Department, and Nicolas Becquet, Project Manager, APL.