Data Centers & Cloud
Physical and logical controls for hosting infrastructure
Threshold in Article 12 of Directive (EU) 2023/1791 and Commission Delegated Regulation (EU) 2024/1364 for reporting to the European database on data centres.
Data centers provide the foundation for cloud and enterprise computing, requiring robust physical and logical security controls. Thalorin supports data center operators with compliance infrastructure addressing facility security, environmental controls, and the operational requirements of hosting sensitive workloads.
Article 12 of Directive (EU) 2023/1791 turned the facility into a reporting entity in its own right, and Commission Delegated Regulation (EU) 2024/1364 fixed what that means in practice. Operators of data centres with an installed information technology power demand of at least 500 kW communicate energy consumption, water input, waste heat reused, average IT equipment intake air setpoint and renewable sourcing to the European database. The first submission fell due on 15 September 2024 and covered 2023; since 15 May 2025 the preceding calendar year is due by 15 May.
A second regime reads the same building. NIS2 lists data centre services in Annex I as digital infrastructure, and Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets the technical requirements the operator is supervised against. Article 6(31) defines a service rather than a room, and Recital 35 puts in-house corporate data centres owned and operated by the entity concerned, for its own purposes, outside the term altogether — which is exactly the boundary an enterprise operator that has started selling capacity has to reason about honestly.
The most misread artifact here is the Tier certificate. Uptime Institute's Tier Certification of Design Documents ratifies an engineering and architectural specification, not a building, and every award issued after 1 January 2014 expires two years after the award date. Neither it nor Tier Certification of Constructed Facility speaks to how the site is run: that is Tier Certification of Operational Sustainability, which takes both as prerequisites, or the separate Management and Operations Stamp of Approval. A brochure claiming Tier III is describing topology, and possibly a lapsed drawing set.
What the platform holds here is the site itself. Control state binds to the facility, the hall and the cage that produced the evidence, so a badge reconciliation, an NFPA 75 suppression inspection or an excursion outside the ASHRAE TC 9.9 envelope resolves to the tenants whose inherited controls depend on it — and one state answers the energy filing, the supervisory authority and the tenant's auditor without three separate collection exercises running against the same building.
Technology companies must prove their security
An annual filing to the European database
Operators at or above 500 kW communicate the preceding year's energy, water, waste heat and renewable figures by 15 May. The reporting party is the operator, not the tenant generating the load.
A design certificate with an expiry date
Awards issued after 1 January 2014 run out two years from the award date, and nothing in a marketing page says so. Buyers check the Tier numeral, not the date, so the claim outlives the evidence behind it.
Carved out of the tenant's report
The operator's controls are named in the tenant's SOC 2 but tested only in the operator's own. What joins the two is a list of complementary subservice organisation controls that nobody owns end to end.
Physical access evidence spans shifts and sites
Criterion CC6.4 restricts physical access to authorised personnel, and the sampled population is badge records, visitor logs and escort sheets across every hall, shift and contractor. One unreconciled credential is a finding.
How Thalorin helps
Physical security compliance
Badge, visitor and escort records sit against the hall and cage they belong to, so the CC6.4 sample is drawn from the access system rather than rebuilt from sign-in sheets.
Environmental control documentation
Temperature, humidity and power telemetry are retained against the ASHRAE TC 9.9 thermal envelope and the EN 50600 availability class the site claims, excursions included.
Facility access management
Authorisation lists reconcile against the identity source and against contractor and tenant rosters, so a terminated engineer or a departed colocation customer loses site access on a recorded date.
SOC 2 Type II for data centers
The subservice decision — carve-out or inclusive method — is recorded with the complementary subservice organisation controls it hands to tenants, and evidence is bound to the observation window rather than gathered at fieldwork.
Multi-tenant isolation controls
Shared power, cooling and cabling paths are modelled as dependencies between tenants, so an isolation claim about a cage carries the shared infrastructure it actually rests on.
Disaster recovery compliance
Failover exercises and maintenance performed under load are held as dated records against the availability class the site publishes, not as a plan document with no exercise behind it.
Data Centers & Cloud: common questions
Does my data centre have to report to the European database?
If it sits in the EU and its installed information technology power demand is at least 500 kW, yes. Commission Delegated Regulation (EU) 2024/1364, made under Article 12 of Directive (EU) 2023/1791, requires the preceding calendar year's energy and IT energy consumption, water input, waste heat reused, intake air setpoint and renewable sourcing by 15 May, with power usage effectiveness and water usage effectiveness derived from them. Member States add their own layer: Sweden pairs the filing with a national notification and exempts sites used for security-sensitive, defence or civil contingency purposes under its Protective Security Act (2018:585).
Is a company's own server room in scope of NIS2?
Usually not as a data centre service. Article 6(31) of Directive (EU) 2022/2555 defines that service as structures dedicated to the centralised accommodation, interconnection and operation of IT and network equipment together with power distribution and environmental control, and Recital 35 says the term should not apply to in-house corporate data centres owned and operated by the entity concerned, for its own purposes. Selling capacity to third parties changes the reading, and the organisation may still be in scope through its own sector.
Does an Uptime Institute Tier certification say anything about operations?
No. Tier Certification of Design Documents ratifies an engineering and architectural specification and Tier Certification of Constructed Facility assesses the building as built; both concern topology. Operations are assessed separately, through Tier Certification of Operational Sustainability, which takes the other two as prerequisites and is awarded Bronze, Silver or Gold, or through the separate Management and Operations Stamp of Approval. Design awards issued after 1 January 2014 expire two years after the award date.
What can a colocation tenant actually inherit from the facility?
Physical and environmental protection, and very little above it. A colocation tenant inherits the operator's site security, power, cooling and fire protection — broadly the physical and environmental protection family in NIST SP 800-53 — while logical access, configuration and monitoring stay with the tenant. In a SOC 2 that boundary is the complementary subservice organisation controls listed in the operator's report. Reading a facility report as coverage of logical controls is the error that surfaces at the tenant's own fieldwork.
Should a facility certify against Uptime Institute or EN 50600?
They answer different questions. The Uptime Institute Tier Standard classifies topology, and separately operations, and is awarded by Uptime Institute itself. EN 50600, with the closely aligned ISO/IEC 22237 series, assigns availability classes across power supply, environmental control and telecommunications cabling plus a protection class, and is assessed by third-party certification bodies. ANSI/TIA-942 covers overlapping ground as a telecommunications infrastructure standard. Which one carries weight depends on the procurement documents you are answering.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
Talk to us about Data Centers & Cloud.
See how one evidence artifact satisfies Data Centers & Cloud requirements alongside every other framework you carry.