Compliance

A wise man once told me, "All great partnerships have one thing in common; that is that both parties gain value from the partnership.” To me, this seems pretty obvious, but today in the IT space you see many partnerships of convenience which really just involve product placement or other more one-sided options. That’s part of the reason I'm so excited about the news we announced today with one of our top partners, Equinix. Today, we announced a very special (dare I say unique?) data center that we are building with Equinix and Digital Realty. The building is adjacent to our current "Vault" data center located in Dulles, Va. and is 64,000 square feet, built to tier3 standards. We’re calling it the IBX Vault.

As we were finalizing our own compliance reports this past period, I watched with interest as many hosting companies and auditors rushed to issue or claim they had SSAE16-SOC2. What’s wrong with a SSAE16-SOC2? Well, for starters, it doesn’t exist. In layman's terms, SSAE16 comes in a couple of flavors, but was designed much like the original SAS70 to show controls in support of financial audits and not designed at all for data center operations.

When I left the industry in 2005, there were no large providers of custom, complex, compliant solutions. Most hosting companies used an approach akin to a “Meal d’Value” at the local burger joint – and special orders certainly upset them!

Compliance in the operations world is usually driven by some combination of acronyms and the technical and operational requirements they imply. In the government space, it may mean FISMA, DIACAP; and in the commercial space, we are most familiar with PCI, HIPAA, SOX. In an environment such as Carpathia Hosting where we have a wide variety of both commercial and federal customers, our operations organization has to be able to support our clients compliance requirements, whatever acronym they have to use.

Simply put, a compliant data center is a data center that conforms to a set of regulatory rules, specifications, standards or laws. Conforming to mandated laws or standards to meet federal and commercial regulations requires a considerable investment infrastructure, personnel and services. However, due to the significant cost, many commercial or private data centers have not made the proper investment in the physical, environmental and operational controls and services to meet the minimum regulatory requirements.

The hosting industry is often viewed with two lenses - “who” service is delivered to vs. “what” is being delivered. But the most common way of segmenting hosting is “mass market” and “complex hosting”. With the ever-increasing number of providers of hosting services and the explosion of cloud computing providers, it feels like the industry is really looking for more granularity when it comes to describing itself.