In mid-December the Greenergy Data Centers data center on the edge of Tallinn was awarded the EN 50600 certificate, which no other data center in the Baltics or Finland can show. The audit lasted more than two and a half years, and the result is another milestone in the success story of Estonia as an IT nation.
Tõnu Grünberg, CEO of Greenergy Data Centers, and Joachim Faulhaber, head of the data center assessment department at TÜViT. Photo: Andres Oolberg.
The value of the EN 50600 certificate lies in the assurance it gives the data center's customer. Since it is the highest European standard a data center can meet, in simple terms it means the highest reliability, security and energy efficiency.
Joachim Faulhaber, head of the data center assessment department at the German company TÜViT, came to Estonia to hand over the high recognition in person. We asked about the future of EN 50600 and why such certificates are needed at all.
Why do data centers need a separate certificate?
In recent years the data center market has grown by 20 percent every year. Previously people looked at information security certificates such as ISO 27001, but those do not take into account the infrastructure that ensures reliability and energy efficiency, which is of key importance in such data centers. In addition, something is needed to define the physical security requirements of data centers.
A modern digital society needs a foundation, and that foundation is the data center itself. That is why, nearly 10 years ago, development of the EN 50600 certificate began, to turn the focus onto the physical side of data centers.
Is there also an ISO certificate that focuses on the physical side of data centers?
It is coming. When Greenergy Data Centers started its EN 50600 certification project, ISO 22237 was still under development. According to the latest information, three of the seven parts of ISO 22237 have been published, with more to come in the coming years. But since ISO 22237 is based on the EN 50600 standard, Greenergy Data Centers can look forward to a smooth transition to ISO 22237 in the future.
Which way is the wind blowing in the certification landscape? Has holding a certificate gained value in companies' eyes in recent years?
Certainly. There is ever greater demand for such certificates in the market, especially from government agencies and authorities. The private sector is also showing more interest in certificates.
Is EN 50600 a European standard, or does it carry weight elsewhere in the world too?
National standards are often not recognised internationally. But when a whole region, such as Europe, recognises a standard, then naturally it is taken into account in Asia or America too. If the EN 50600 certificate becomes part of an ISO standard (a standard recognised by the International Organization for Standardization), there is no doubt the latter will carry global weight.
What is needed to turn the EN 50600 certificate into an ISO standard? Do we have to reach agreement with American or Asian organisations?
Exactly, that is a process under way right now. In some parts the agreement already exists. I can say that only small changes have been made to the current EN 50600 requirements. As regards the mechanical infrastructure and electrical system of data centers, the EN 50600 certificate corresponds practically one to one to the ISO standard. The other parts will probably go the same way, and no serious changes will need to be made.
So those who hold an EN 50600 certificate now will get the ISO certificate with little effort in the future?
I believe so. I am fairly confident the transition from the EN 50600 certificate to ISO will be very smooth. That is a great advantage of the current certificate for companies.
What does the certification process look like at present?
It is good to explain this with the example of Greenergy Data Centers. I remember well the first workshop we had with GDC in April 2020. The goal was to get on the same wavelength, so that they would understand what requirements we have and we would understand exactly what kind of facility was planned on the edge of Tallinn.
Then came a phase in which we were sent piles of documents, diagrams and plans to review and assess. That phase lasted nearly half a year. In return we sent a very detailed report that gave GDC the assurance it needed for the construction phase. Essentially it means that if everything is done as written in the documents, the certificate will be obtained. Although the EN 50600 certificate covers not only construction but also operating the facility in accordance with the requirements.
After the construction phase, in April 2022, we started the first audit. We went through the data center from end to end and checked everything. The second audit was in autumn 2022. Afterwards we gathered all the information, compiled a report and sent it to the certification body. They check whether all requirements have been followed, whether the assessors really are impartial and so on. The certification body decided to issue the certificate, and now we are in Estonia to hand it over.
From start to finish it took two and a half years to obtain the certificate, but in fact that is not such a long time, because construction fell in between. We have had projects that lasted longer.
Is certification done differently elsewhere in the world, in America for example? Or is the name different but the principle the same?
In the USA there is the Uptime Institute, which is also known worldwide. They too certify data centers on the basis of mission-critical infrastructure, so the goal is very similar to EN 50600.
The difference is that it is a private company, so its working process differs from that of European certification bodies. Our activities are monitored by an accreditation body and everything has to comply with the ISO 17065 standard (the standard for bodies certifying products, services and the like). Uptime, by contrast, operates on its own.
So essentially you audit companies, and at the same time other institutions audit you, so that everything meets the requirements?
Exactly, that ensures our credibility and reputation.
Are there other bodies in Europe that issue EN 50600 certificates?
There are other companies, but we are pleased to say that about 70 percent of all certificates issued to data centers have been issued by us. We are well known in this field and have more than 21 years of experience, so the foundation is good.
Now that Greenergy Data Centers has the certificate, what must be done to keep it in the future?
The EN 50600 certificate is valid for two years, after which recertification can be applied for. Fortunately most of the work for the original certificate has already been done. Provided neither the building itself nor the technical side has changed in two years, the recertification process is shorter and simpler, because we focus primarily on the operational side: the staff and how they operate the facility. We check that nothing has changed in two years, or else we have to assess the effect of those changes on security and reliability.
In general, recertification takes about 30–40 percent of the volume of the first certification for both parties.
Finally, what is the main benefit a company gets from such high recognition?
One important benefit is for the company itself: you do not have to worry every day about whether everything has been done correctly. Thanks to the EN 50600 certificate you know you have done everything right from the start; the precautions are in place, so even if one of the systems fails, the facility keeps operating.
The other benefit is for customers. Such a certificate ensures credibility. Customers see that a separate, impartial party has confirmed that your data center meets all the conditions that ensure their data is kept safe.