Reliability is becoming the most important commodity in the data center. Most of your customers would agree that reliable access to your computer systems is more important that application features.

IT staff are good at supporting applications. They are usually talented at designing reliability into your most important business software: application, server and connection redundancy, along with data replication and fail-over procedures. How good is your staff manage the facilities side of reliability?

The lion’s share of outages are related to data center downtime. Power, cooling, security, fire suppression and building failures account for the majority of outages in the enterprise data center.

Large and small companies alike are investigating alternatives to the in-house data center. Some consider outsource data center facilities for high data center uptime (high reliability). 99.995% uptime (27 minutes of downtime per year or less) is the level expected of tier IV data centers. Many CIOs feel that their most mission critical applications require mission critical facilities with 99.995% uptime.

Selecting outsource data center facilities can be tricky. Also known as colocation facilities, these outsourced data centers come in a variety of shapes and sizes. Some focus on IT services. A few focus on providing high-tech real estate with flexible options, so that savvy IT organizations can grow and change without barriers.

Wholesale colocation facilities like Lifeline Data Centers in Indianapolis, Indiana

• Affordable colocation
• 99.995% uptime
• Hardened data center facilities
• Low data center power costs
• Pay as you grow rack and power pricing
• Fifteen telecom carriers in a carrier-neutral data center
• No monthly cross-connect fees
• SAS70 data center compliance
• Data center compliance: HIPAA, FDA, NIST and TIA 942 compliant data centers

Need more reliability? Use wholesale colocation facilities. Leverage decades of experience at Lifeline Data Centers, 317.423.2591.

A CIO strategy that includes flexible data center facilities can help organizations through changes in the economy, lines of business, revenues and profitability.

Flexible data center facilities help CIOs add racks, power density and temporary systems as needed. Outsource colocation and outsource data center facilities can deliver this flexibility as an operating expense rather than capital costs.

Outsource data center facilities that offer private cage space and separate square footage/active rack charges allow organizations to build for growth and change.

Carrier neutral data centers with no cross connect fees and help control long-term telecom costs and improve network reliability

Building a hardened data center with 99.995% uptime (equal to Tier IV data center ratings) is cost-prohibitive for most companies. Leasing space in an affordable colocation facility with 99.995% uptime is easy.

Maintaining data center compliance is expensive. Data center certifications can cost hundreds of thousands of dollars to implement and tens of thousands to maintain. Outsource data centers let you outsource data center compliance, such as SAS 70 data center certification, TIA-942 compliant data centers, HIPAA, FDA, FISMA and other regulations.

The most flexible Midwest colocation provider, Lifeline Data Centers, can help you make your data center flexibility strategy happen. Call 317.423.2591.

Nathan Hatch is President and CEO of C7 Data Centers, a privately held company focused on providing high-value data center solutions for colocation, disaster recovery, data backup and virtualization.
Nathan Hatch, C7 Data Centers

Customers want to know that they can trust their data center provider to meet the most rigorous controls standards, demanding accountability and transparency. The American Institute of Certified Public Accountants (AICPA) created a “Statement of Auditing Standards” certification termed “SAS 70” to help customers know that their data center provider has effective internal controls in place for managing the design, implementation and execution of customer information.

The basic certification is called SAS 70 type I, which an independent service auditor assigns after a thorough review of the degree to which a data center provider fairly represents its services in regards to the operational controls that have been implemented to meet set objectives.

more of the Data Center Knowledge article

The following is excerpted from the April 12, 2010 Information Week article “Cloud Computing Risks”, written by Greg Shipley. Data center certifications and data center compliance are not always what they seem.

Most IT pros are familiar with the Statement of Auditing Standard (SAS) No. 70 from The American Institute of Certified Public Accountants. Put simply, it’s an auditing standard for service organizations reporting on controls put into operation. While there are two types of SAS 70 audits, Type I and Type II, Type II is the most popular as it involves a minimal amount of testing for specified controls. The output of a SAS 70 Type II audit is typically a “letter of attestation” by the auditor and a report on the “control objectives” that were reviewed during the audit.
Unlike prescriptive standards such as PCI-DSS (Payment Card Industry Data Security Standards), SAS 70 defines the process – the how – in which an audit is performed, but not the criteria – the what – that must be included during that audit. There is certainly value to a SAS 70 Type II audit, but the relevance of that value heavily depends on the controls being investigated – the what. As any IT professional who has undergone a SAS 70 will attest, you can simply remove controls that you don’t want audited. Don’t have desktop patching? Strike it. No security integrated into the software development life cycle? Don’t have your auditor look at that. Don’t run vulnerability scanners? Keep it off the objectives list.
The practice of massaging SAS 70 control objectives is bad news for security, and unlike standard controls in the accounting world, we don’t have Generally Accepted Accounting Principles for IT Risk. Even worse, many of the templates that SAS 70 auditors use are based on outdated controls. For example, password strengths don’t matter when an attacker can gain administrative access to critical systems via unpatched vulnerabilities. The value of a report is only as good as the controls it examines and the scope of its coverage.
Aggravating the situation, we’ve seen cloud providers that will provide a letter of attestation but refuse to list the SAS 70 control objectives. This akin to saying: “Yes, we were audited, but no, we won’t tell you what the auditors looked at.” Fortunately, many IT professionals and mature cloud providers see the absurdity of this situation. “A SAS 70 letter of attestation without visibility into the control objectives is meaningless,” says Google’s Feigenbaum. We couldn’t agree more.
Just like technology evaluations, the value of an audit is all about the criteria and the testing methods. So how do we make sure the right controls are looked at? Build the beforehand using a standards-based formula.

We’re hearing more stories and seeing more companies move their infrastructure out of a virtual environment and back into a physical environment using high-reliability outsourced data centers.

Why are these companies making the switch? Long-term costs. Virtual environments often charge by the resource, i.e. disk, processors, number of servers, and SAN throughput. Companies using virtual infrastructure are finding that the cost of these resources over time becomes too high. If the company is a SaaS provider, the costs eat into profits. Companies using virtual infrastructure for internal IT see an ever-escalating monthly operating expense.

So these companies spend some time evaluating their infrastructure and come up with a suitable hardware/software architecture. It’s much easier these days to build in reliability and redundancy. The companies are using hypervisor software like VMware, multiple physical servers, redundant SANs, dual switches and dual firewalls. They end up with an architecture that can survive multiple failures with no interruptions in service. And often times the hardware/software architecture pays for itself in one year when compared to their virtual environment. Long-term costs go down, and the company ends up having more control over their infrastructure.

The new equipment needs a home. Companies are using affordable colocation rather than expensive IT managed services providers. What are they looking for?

• 99.995% uptime – 27 minutes of downtime per year or less, equal to that of an Uptime Institute certified tier IV data center
• Fair pricing – a simple, easy-to-understand data center pricing model helps with forecasting and incremental growth
• Hardened data center facilities – buildings that are F5 tornado resistant
• Carrier neutral data centers – many choices on telecommunications providers for bandwidth and transport
• No cross connect fees – no monthly add-on fees for connections directly to the carriers
• Data center certifications and compliance – SAS 70 Type II data centers, TIA 942 compliant data centers

What are the savings? Do the math. You may find out that you’re spending too much on your cloud computing data center’s virtual environment.

Do you need to drive the costs out of your application delivery model? Call Lifeline Data Centers at 317.423.2591.

More and more companies have concerns about data center certifications and data center compliance. One of the most common questions that companies ask us is whether we have a SAS 70 data center certification.

For those of you who aren’t familiar with the term, here’s the definition straight from the SAS 70 about page:

Statement on Auditing Standards (SAS) No. 70, Service Organizations, is a widely recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). A service auditor’s examination performed in accordance with SAS No. 70 (“SAS 70 Audit”) is widely recognized, because it represents that a service organization has been through an in-depth audit of their control objectives and control activities, which often include controls over information technology and related processes. In today’s global economy, service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on the effectiveness of internal control over financial reporting.

In short, SAS 70 certification means that you have control objectives, and that you adhere to them, as attested in an audit. And Sarbanes-Oxley puts a great deal of weight on the certification.

Before we had our SAS 70 certification, we had prospective clients choose an outsource data center with SAS 70 certification over our data center, even though we offered higher levels of uptime at lower prices.

The strange thing, in my opinion, is that the company seeking SAS 70 certification writes their own control objectives. Isn’t this asking the fox guarding the henhouse? If I’m clever enough to write vague, simplistic control objectives, I can obtain a SAS 70 certification without really having a well-run facility.

What do you think? Is a SAS 70 data center certification like a fox guarding the henhouse?

What are the cost components of your data center? How are you spending money to maintain your computing environment?

In-house data centers spend money on

• Floor space or real estate
• Power to the servers and network equipment (sometimes untracked)
• Power to the air conditioners needed to cool the server and network equipment (often untracked)
• Generators, power conditioning/UPS, HVAC systems
• Security systems
• Maintenance of the generators, HVAC and UPS ad security equipment
• FTE support for the facilities side of IT
• Bandwidth and transport: limited choices and retail pricing from telecom carriers

Companies using outsourced data centers often spend on

• Rack space in shared environments
• Power costs based on something other than usage
• Expensive private suites
• Bandwidth and transport: limited choices and retail pricing from telecom carriers

Regardless, companies often purchase inferior services:

• No hardened data center facilities, or facilities not built to withstand a regional disaster
• Limits on power per rack, cooling and space that can drive up future costs
• Significant single points of failure in the power and cooling systems
• Time and money for internal IT resources to solve facilities and physical plant problems

Lifeline Data Centers is different. Lifeline offers outsource data center facilities with:

• Data center expertise
• High data center high uptime
• A simple data center pricing model that allows you to pay as you grow
• Mulitiple carriers in a carrier neutral data center
• No cross connect fees

Call Lifeline Data Centers at 317.423.2591 to learn how you can reduce costs while improving data center uptime.

Lifeline’s Eastgate facility is adding both carriers and customers alike! Less than a year after opening, almost half of the first floor of the Burlington building is under contract.

Savvy business owners and IT organizations use Lifeline’s pay-as-you-grow data center pricing model to predict and control IT facilities costs. They use carrier neutral telecommuncations access and no cross connect fees to reduce their telecom overhead. They leverage Lifeline’s data center certifications such as SAS 70 Type II. and compliance such as SAS 70 Type II, HIPAA, FISMA, and FDA.

Can you drive unpredictable costs out of your IT operations while improving uptime? You can at Lifeline.

If you need affordable colocation (computer room space) with high uptime and low monthly recurring costs, call Lifeline at 317.423.2591. Choose Lifeline. Stop worrying about downtime.

One of the most common questions financial services companies ask us is whether we have a SAS 70 data center certification. For those of you who aren’t familiar with the term, here’s the definition straight from the SAS 70 about page:

Statement on Auditing Standards (SAS) No. 70, Service Organizations, is a widely recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). A service auditor’s examination performed in accordance with SAS No. 70 (“SAS 70 Audit”) is widely recognized, because it represents that a service organization has been through an in-depth audit of their control objectives and control activities, which often include controls over information technology and related processes. In today’s global economy, service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on the effectiveness of internal control over financial reporting.
In short, SAS 70 certification means that you have control objectives, and that you adhere to them, as attested in an audit. And Sarbanes-Oxley puts a great deal of weight on the certification.

Before we had our SAS 70 certification, we had prospective clients choose an outsource data center with SAS 70 certification over our data center, even though we offered higher levels of uptime at lower prices.

The strange thing, in my opinion, is that the company seeking SAS 70 certification writes their own control objectives. Isn’t this asking the fox guarding the henhouse? If I’m clever enough to write vague, simplistic control objectives, I can obtain a SAS 70 certification without really having a well-run facility.

What do you think? Is a SAS 70 data center certification like a fox guarding the henhouse?

With the current enthusiasm about cloud computing, some have argued that cloud platforms will replace the data center, or reduce the need for physical infrastructure. Or perhaps that all the world’s applications will run out of just five huge cloud computign facilities.

more of the Data Center Knowledge article from Rich Miller