I’ve toured several data center facilities since I’ve been involved in IT. I’ve also been a direct and indirect customer of many of them. First let me say that I am happy that there are standards available that help us to measure quality control and accounting practices. Without these standards, there would be no chance of forming an unbiased analysis of data center performance. That said, I have noticed that there is absolutely no correlation between good data centers and compliance. I recently toured a SAS70 Type II compliant facility that sits on a single power grid.

I’ve been a customer of an ISO 9001 facility where a technician used a pen to reset my Dell PowerEdge and hit it hard enough to break the reset button. I had to have a Dell Technician come in and replace it, which meant that the machine was powered down for over an hour while he did it. That same facility had to shut down their generator for several hours because of a fire in one of the power grid rooms. The fire marshall required the shut down because of the proximity of the generator to the grid. This is a symptom of poor design and location.

I’ve also toured and have been a customer of facilities that have not obtained any standards compliance certifications at all, but run their business as though they were compliant. This seems like the best of both worlds, because certifications tend to increase the price of services exponentially if for no other reason than just the perception that they provide. The other thing to keep in mind is that there is no such thing as an unbiased evaluation when the standards body is making money for the evaluation and renewal of certification. I would be much happier if it was truly independent and if the industry as a whole sponsored the standards bodies rather than paying for certification. Some people would argue ‘how is that any different?’. To them I would say ‘you are probably right, do you have any better ideas?’.

Again, I am not trying to be some doomsday prophet here or anything. I’m not saying that data centers should not apply for certification. I am only saying that certification is not always an indication of quality or good practice.

For more information on the various certifications available:

ISO 9001:2000

SAS70

PCI DSS