Comparison of ISO Certified Hosting UK

ISO Certifications in Data Centers - What's Behind Them and How Important Are They?

Awareness of the growing threat of targeted attacks on electronic infrastructure in even neutral countries has significantly increased, not least due to Russia's war against Ukraine. However, new vulnerabilities and risks have been identified simultaneously, some of which do not even meet the minimum certification requirements according to an ISO standard - for example, because there are no effective access controls preventing third parties from entering a server room. It is therefore necessary, in one's own interest, to pay attention to compliance with the most important standards when choosing a data center.

Which ISO Standards are Relevant for a Data Center?

Three different European guidelines are used for a data center and web hosting:

• ISO 27001 as a security standard in IT infrastructures
• ISO 22237 or EN 50600, which control a data center
• ISO 50001, which only ensures the reliability of energy supply

The general standard for data security in computing facilities, as well as in IT infrastructure, is found in the EU security standard 27001 as "Information Security Management System Standard". However, this regulation primarily deals with technical aspects such as encryption of sensitive data and defines as an ISO standard a general security standard that commercial actors on the internet must adhere to for certification as commercial participants. Nevertheless, many web hosts advertise with these certificates, even though they practically represent only a minimal basic requirement.

Specifically for data centers, there is the much less known ISO 22237 or its international counterpart EN 50600. It is divided into several sections and includes a binding security standard for security concepts, the reliability of power supply, climate control, redundant connection to international IT gateways, as well as other measures such as site security and access control. The classification is done in four categories from availability class 1 without redundant structures to 4 with fault tolerance and multiple independent supply options.

Web hosts may also mention the ISO 50001 certification, which, however, only describes the structure and setup of the energy network and does not make a relevant statement about the security and reliability in a data center or the web hosting offered.

Who is Responsible for Certifying a Data Center?

The verification and compliance with the specified standards have so far not been mandatory and are at the voluntary discretion of the company. The situation becomes even more problematic because, similar to certain industrial protection standards - such as IP6X against moisture ingress in electronic devices - no external inspection is required. In practice, this allows a company to issue certification for its data center and web hosting without any external control. Reputable providers will, of course, engage renowned institutes such as TÃœV - however, it is highly recommended to verify the certificates and details such as the issuer.

How meaningful are ISO certificates for web hosting or a data center?

The fees for verification according to an ISO security standard must be fully covered by the responsible data center and do not necessarily include web hosting. As these are high costs, especially for small web hosts, they often forego official certification due to financial reasons, even though they essentially meet all requirements. Furthermore, the ISO standard 22237 is currently (as of Spring 2023) still under development and is only partially valid.

Overall, certifications according to ISO standards speak for a web host and signify that fundamental infrastructure standards are met. However, they should come from independent testing bodies and have sufficient significance from which specific and relevant qualities of a data center can be derived.