Uptime Institute

Uptime Institute – one of the most known and the international certified institutes enjoying confidence, the developed own standard of reliability of data processing centers. This standard incorporates the best international experience of creation and operation of DPC. Unlike other qualifications accepted in the world, the Uptime Institute standards consider, first of all, the interests of corporate clients also are focused on protection of investments into construction of DPC. Such approach allows to put necessary requirements to reliability and security of future data center at a design stage, to create optimal conditions to its operation and by that to achieve effective economy of the project.

Moscow office

The Uptime Institute company classifying data centers by reliability level opened the Moscow office at the beginning of 2013. In addition to certification of DPCs the company is engaged in consultation of customers during their creation. It will become the main objective of a small technical command under the leadership of Alexey Solodovnikov.

2020: How to support operability of DPC if key staff caught COVID-19 or sit on a quarantine

In March, 2020 Uptime Institute prepared recommendations of how to react to a pandemic of a coronavirus of COVID-19 of the industry of DPC. The report was issued with the purpose to help operators of objects of critical infrastructure to be prepared and respond to influence of a new coronavirus. TAdviser studied the document.

According to the report, in such situations as a pandemic, crucial objects meet special difficulties as because of risk of absence of key staff on an etiology or a quarantine, and owing to other long factors which can affect capability of the operator to support continuous work.

Aging of personnel in some regions means that, despite all efforts, the industry of data processing centers can be more vulnerable to COVID-19, than other industries. It represents a problem, considering the existing and well documentary staff shortage which the industry faces. The current events increase need of increasing efforts from the industry, educational institutions and trade organizations on strengthening of programs of preparation and personnel training, - authors of the report say

Despite all efforts, the industry of data processing centers can be more vulnerable to COVID-19, than other industries, declare in Uptime Institute.

In a similar way, according to them, use of automation and remote monitoring is able to allow objects to work more effectively and longer, with the smaller number of necessary personnel on an object.

The pandemic can accelerate a long-term trend in this direction. The same treats performance and instruments of remote joint work, said in the report

Authors of the report designate by the first step of business in the conditions of a pandemic protection of the platform of the enterprise and its personnel. The speech about the following actions:

• review of operational processes;
• the maximum elimination of access for all suppliers whose presence is not necessary and tracking of those who should be present;
• review of the training program of suppliers and inclusion of discussion of expanded procedures of health protection in it and security and rules of work of the platform;
• to suspension of all insignificant construction projects and coordination of the work with contractors guaranteeing application subpodryadchikyami / suppliers of adequate precautionary measures in case of need of continuation of the project;
• creation of a separate, safe input for all parties participating in the project and introduction of isolation of personnel of the project from the operating personnel;
• updating of basic materials;

When execution of projects and maintenance are reduced, use the slowed-down cycle of works as an opportunity for review and updating of plans and technical library. It can be executed out of work location. Encourage documentation and knowledge transfer from experienced personnel. It can be executed in the form of the annotated procedures and the managements of video conferences between the relevant parties, etc., said in the report

• gain of sanitary processing;
• access restriction on a critical object;
• testing of all connections of a virtual private network (VPN) for ensuring reliable access and the subsequent transfer of all personnel which are not responsible for critical processes in DPC to outwork;
• ensuring access through VPN to a management system for the building (BMS) for remote monitoring of DPC;
• providing detailed instructions to personnel on connection to VPN servers;
• ensuring access to standard operational procedures (SOP) and abnormal operational procedures (EOP) for a possibility of remote shared control in case of need;
• to check of accuracy of the description of procedures of SOP/EOP and also a possibility of their correct execution by persons for which it is not daily activity.
• consideration of a possibility of delay/cancelling of all personal meetings and use, with respect thereto, e-mail, telephone and audio/video of conference communication;
• a reminder to employees using signs and daily instructing about their responsibility for sanitary processing and also assistance in it;
• readiness for the difficulties caused by work with reduced number of personnel;

Develop a matrix of threat of insufficiency of personnel for different scenarios of absence of employees for work. For example, less than 25%, 25-50%, 50-75%, 75-99%, 100%. For each scenario sum up the following: influence on critical and noncritical functions of business, elements of response to operation of DPC, impact on the level of service and on group metrics, - is recommended in the report

• research and testing of technologies of remote monitoring / management, automation, etc.;
• the direction of employees on self-isolation with indication of to work with disease symptoms far off during the next 14 days;
• the recommendations of leaving on an independent quarantine for necessary term to the employees who had close contact with the confirmed COVID-19 carrier;
• review of appointment of crucial employees and their deputies and an examination of the last about roles and duties of those whom can temporarily be required to replace with it;
• prohibition/reduction of all trips which are not urgent;

The organizations need to make complete clarity about the nature of movements. For example, short local trips against longer/international trips and development of the corresponding instructions, - authors of the report write

• prohibition/reduction of movement between platforms;

If such trip is necessary, take steps to be convinced that the probability of cross infection is minimized as one platform can reserve another, - authors of the report advise

• planning of necessary visits for maintenance;

Operators should plan ways of implementation of maintenance in advance and get necessary permissions if like those are required. Permissions can depend on the applications/services executed in DPC, - authors of the report pay attention

• review of priorities of maintenance;

Review plans of service and locate on priorities: define what tasks can be lowered in a priority, are executed in the last queue or not executed in general if the operational personnel are reduced to a minimum, - authors of the report note

• consideration of effects of the postponed service owing to possible increase in risk of failure of components or systems by it;

Always have on hand the plan of response to any considerable problem, as required coordinating work with suppliers to be sure that problems can be solved. If the problem of damage cannot be solved timely, be convinced that procedures of safe shutdown and isolation of the equipment and digital infrastructure are rather reliable for neutralization of losses because of the failed equipment. In process of the course of time and the remaining restrictions review the postponed tasks and define whether risks of above-reasonable admissions raise the proceeding delays, - authors of the report write

• creation of commands of responsible personnel of the main and reserve platform and prohibition of cross contacts between their members;
• you will lock close interaction between changes;
• appointment consideration of at least one self-isolated person on each position for each change for a call at emergency;
• two-week rotation for the working groups working in change;
• avoiding of sharing of a working space.

Most DPC limited available working spaces for personnel. If it is possible, appoint conference rooms or other premises for use by personnel of change on a variable basis. Configure panels of a management system for the building (BMS) and access to network so that changes were not included into working spaces of each other, - it is recommended in the report

• avoiding of sharing of the equipment;
• consideration of a possibility of system implementation of tracking of contacts;
• to preparation for the emergency accommodation of personnel in DPC;

Daily register information on the state of health and location of personnel, representatives of suppliers and the other involved persons for the purpose of tracking of potential impact of a virus or any symptoms, - authors of the report say

Authors of the report designate by the second step of business in the conditions of a pandemic its readiness for this phenomenon. It includes the following actions:

• development of the specific plan of readiness for a pandemic.

This plan should include multilevel reaction and accurately define actions which need to be undertaken at each level and also the circumstances leading to implementation of the following level. Besides, the plan should provide situations when the personnel can be incapable to get access or, on the contrary, to leave the platform in the shortest possible time.

• consultation with insurance companies and lawyers on such questions, as requirements to cleaning, agreements on the level of rendering service (SLA), notification, etc.
• impact assessment on IT services;

Response to COVID-19 can influence Internet traffic, workloads and requirements of availability to some clients. Operators are recommended to discuss with clients, both internal, and external, any potential impacts for their work, in particular at the planned updates or migrations of systems, accumulation of capacities and also probable delays of those projects which can influence work of business divisions and execution of tasks, said in the report

• support of communications with personnel, clients and partners;
• tracking of public information resources for the purpose of informing personnel on a current status of a pandemic and the best practices of maintenance of a safe and healthy working environment;
• providing personnel with accurate instructions on the policy of the company and official provisions for manifestation of symptoms of a disease of a possible disease, an order and duration of an independent quarantine, providing a holiday on a disease / a regular paid leave, to an insurance coverage, etc.;
• informing personnel on the current level of reaction and its influence on daily activity;
• readiness for violations in a supply chain;

In addition to resources, to the main for business functions, provide appropriate level of deliveries of products reducing distribution of causative agents of an infection: sanitizing wipes, hand sanitizer, masks, gloves, contactless thermometers, suitable cleaners for different types of the equipment, etc. Also consider potential long-term violation in a supply chain of critical spare parts and consumer goods. The components which are manufactured in China or other regions which the virus considerably affected can be inaccessible within many months, - authors of the report recommend

2015: Uptime Institute cancelled "paper" certification

On July 13, 2015 it became known of change of rules of certification for commercial data centers. It the organization tries to fight against unauthorized use of its diplomas in the marketing purposes.

Uptime Institute estimates the level of reliability of DPCs at different stages of their existence: it is possible to receive separately the certificate for the project of construction (Tier Certification of Design Documents) and the ready platform (Constructed Facility). The problem is that in a work progress a lot of things can change and the result of construction will strongly differ from the project documentation. As a result the data center which project (on the basis of only documents) received the level of reliability Tier III far does not correspond to this level in reality.

But existence of the certificate of Uptime Institute on the project gives to it the grounds is proud to declare the Tier III level for the sake of customer acquisition and improvement of sales (certainly, it is about the commercial DPCs providing cloud services or services of a collocation). Thus, the company misleads the customers who are not understanding a difference between certificates, forcing them to pay for what they do not receive. According to a number of experts, such practice – open deception as customers consider the constructed data center to the corresponding criteria of certification that actually not so.

Current situation sparked Uptime Institute criticism from the industry: according to the speaker of the organization Matt Stansbury, in Uptime received the mass of complaints from providers of services of data centers which spent for expensive certification and were forced to compete in the market with those who did not carry out this procedure for the platform, but declared the high level of reliability. And the two-year "expiration date" set in 2014 for certificates on the project became the first step in fight against abuses. It meant that after Design Document certification the company had to construct data center within two years and confirm the level of the ready platform – otherwise it lost the certificate on the project.

The next step, according to Stansbury, canceling since July 1, 2015 of certificates on the project for commercial data centers. "Main objective of it, – he explains, – not to allow to use the certificate of the project in the marketing purposes, without having undergone certification of the real platform. Between the plan and a result of construction there can be a set of discrepancies".

Uptime Institute will not issue documents or to post the list of the commercial DPCs certifying the construction project on the website. It is only about the companies providing services of a hosting, clouds, collocations, etc. to third-party customers and only about data centers in North America. Changes enter about force since July 1, 2015, and they will not affect the certificates received before this date (in the same way the certificates issued before imposition of restrictions for the term of their action are not cancelled).