Build journey · Mid-size enterprise DC
Build a mid-size enterprise DC
A mid-size enterprise building its primary DC in an onsite room or a colo cage, with a DR target in a second colo or the cloud. The steps below follow build order. Each step names its decisions, what constrains them, what they lock in, and the page that holds the detail.
The journey
This page owns only the scenario assumptions and the step order. Every concept lives on its domain page, and each step links to it. The first choice in the Site model step sets the onsite or colo path for the rest of the build. To record your own choices, open any step in the Design Builder. Journey data version 2026-10-06.3.
| # | Step | What you decide | Detail |
|---|---|---|---|
| 1 | Requirements and capacity envelope | Set the IT load, rack count, growth, availability target, RPO/RTO and compliance scope. Later steps size against this envelope, and compliance scope sets the segmentation model, retention and evidence they must produce. | This page |
| 2 | Site model | Onsite room, retail colo or wholesale colo for the primary site, and where the DR target lives. This choice sets the onsite or colo path for the rest of the journey. Hybrid (an onsite room plus a colo cage for tier-1 apps) is chosen in the resilience step. | Facility: Site model |
| 3 | Resilience and facility rating | Choose the redundancy level and rating to design or contract against. Onsite, decide how to handle the availability gap (A9); in colo, verify the contracted rating. | Facility: Resilience & facility rating |
| 4 | Power | Onsite, the full chain from utility to rack PDU. In colo, contracted kW per cabinet or cage on A/B feeds, plus your own rack PDUs. | Power: What it is |
| 5 | Cooling | Onsite, the plant, containment and controls. In colo, the provider’s density ceiling, containment rules and liquid offering. | Cooling: Cooling decisions at a glance |
| 6 | Racks, layout and cabling plant | Cabinet size, row layout, switch placement, pathways and the structured cabling plant; in colo, the cage fit-out within provider rules. | Racks: Rows, aisles & switch placement |
| 7 | Carrier, edge and WAN | Carrier diversity, the internet edge, cross connects, DCI to the DR site and the SD-WAN hub. | Network: Edge & carrier |
| 8 | DC fabric | Spine-leaf size, underlay, overlay, dual-homing, firewall insertion and out-of-band management. | Network: Fabric design |
| 9 | Compute platform | 3-tier vs HCI, then the host side of the server-to-leaf link: NIC speed and teaming. | HCI: Choosing HCI, dHCI or 3-tier |
| 10 | Storage | Block, file and object mix, the block transport, and whether the storage network is dedicated or converged on the fabric. | Storage: Storage networking |
| 11 | Backup and DR | Backup platform and targets, immutability, DR replication and the vault, plus the replication bandwidth that sizes the DCI. | Backup: Backup network decisions |
| 12 | Security | Perimeter firewall, segmentation model, remote user access, identity and PAM, OT/facility isolation and physical security. | Security: Perimeter: NGFW pair, HMF and sizing |
| 13 | Ops and lifecycle | DCIM, BMS and EPMS, monitoring and how physical work gets done. Physical security is part of the Security step. | Ops: DCIM / BMS / EPMS |
Assumptions
All figures are assumptions for you to adjust. They are plausible round numbers, not sourced.
| # | Assumption | Onsite room | Colocation |
|---|---|---|---|
| A1 | Organization size | 2,000–5,000 employees | |
| A2 | Sites | 1 primary onsite room or building + 1 DR target (second colo, or cloud); a colo cage for tier-1 apps if you choose the hybrid option | 1 primary colo cage + 1 DR target (second colo, or cloud) |
| A3 | Offices | 10–20 branch offices, 1–2 regional hubs | |
| A4 | Remote users | 40–60% of staff work remotely part or all of the time | |
| A5 | Rack count (primary) | 20–30 IT racks at day 1, 50% growth headroom over 5 years | |
| A6 | Rack density | 6–10 kW average; a few 15–20 kW racks; no liquid cooling at day 1 | |
| A7 | Workloads | 800–2,000 VMs (ERP, databases, file, VDI pilot, line-of-business apps), some containers; no large AI training | |
| A8 | Storage | 300–800 TB usable primary; backup copy at 2–3× primary with immutability | |
| A9 | Availability target | Most mid-size rooms are N+1 with single points of failure, so they are not concurrently maintainable; the gap is a decision point in the site and resilience steps. RPO ≤ 15 min and RTO ≤ 4 h for tier-1 apps | Contract a concurrently maintainable facility (TIA-942 Rated-3 / Uptime Tier III-class): '-class' is a contract target the provider must back with a current certificate or equivalent evidence and SLA terms, not a certification. RPO ≤ 15 min and RTO ≤ 4 h for tier-1 apps |
| A10 | Staffing | Small in-house infra team | Small in-house infra team; remote hands used in colo |
| A11 | Compliance | General enterprise (e.g. SOC 2 / ISO 27001 posture); no special regulated enclave. Set the actual scope in the compliance decision of the requirements step | |
Where onsite and colo diverge
Steps not listed here (1, 9, 10, 11, 12) are mostly the same on both paths, which is why the domain pages stay scenario-neutral.
| Step | Onsite room | Colocation | Detail |
|---|---|---|---|
| 2. Site model | You build the room; typically N+1 with single points of failure. Accept the gap, invest to close it, or move tier-1 workloads to colo or DR (A9). | You choose a provider and contract a TIA-942 Rated-3 / Uptime Tier III-class facility, backed by evidence and SLA terms. | Facility: Site model |
| 3. Resilience and facility rating | A typical mid-size room is N+1 with single points of failure. Accept the gap, invest to close it, or place tier-1 workloads in colo or DR. | Contract a Rated-3 / Tier III-class facility and verify that the rating is backed by evidence and SLA terms. | Facility: Resilience & facility rating |
| 4. Power | Full power chain: utility/MV, UPS, generator, distribution to the rack PDU. | Rack PDUs plus contracted kW and A/B feeds. | Power: What it is |
| 5. Cooling | You design and operate the cooling plant. | Provider plant; you follow its containment and density rules. | Cooling: Cooling decisions at a glance |
| 6. Racks, layout and cabling plant | Free layout choice. | Cage fit-out within provider rules. | Racks: Rows, aisles & switch placement |
| 7. Carrier, edge and WAN | Carrier entries and building diversity. | MMR cross connects, carrier-neutral choice, cloud on-ramps. | Network: Edge & carrier |
| 8. DC fabric | OOB shortens recovery; your staff do the physical work. | Console and OOB to every device is the main recovery path; keep remote hands for hardware and cabling. | Network: Fabric design |
| 13. Ops and lifecycle | Full facility operations; you run physical security (detail on Security). | Remote hands and the provider portal; physical security shared with the provider (detail on Security). | Ops: DCIM / BMS / EPMS |
Step 1
Requirements and capacity envelope
Set the IT load, rack count, growth, availability target, RPO/RTO and compliance scope. Later steps size against this envelope, and compliance scope sets the segmentation model, retention and evidence they must produce.
| Constrained by | Business needs |
| Locks in | IT-load envelope that the power design sizes against (4. Power); Heat load and rack density that the cooling design sizes against (5. Cooling); RPO/RTO that the DR design and replication follow (11. Backup and DR); Compliance scope: the regulated-data boundary, retention periods, test cadence and the evidence each later step must produce (12. Security) |
| Detail | This page |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| What do you size the build against? Choose one. | Scenario assumptions A1–A11. Start from the assumption values on this page and adjust them for your organization. | Both | — | This page |
| Your own measured envelope. Replace the assumptions with your measured IT load, rack count, growth and RPO/RTO, and record each change in the decision note. | Both | — | This page | |
| Which frameworks are in scope? Choose any that apply. Governance: Set compliance scope early | General enterprise posture (ISO/IEC 27001 or SOC 2). An ISMS certification or a SOC 2 attestation across the estate, with no regulated-data enclave. This is the A11 default. Neither framework fixes retention periods or test intervals: your own standards set them, and the auditor checks that you meet them. | Both | Retention for logs, access records and video set by your own standard (ISO/IEC 27001 A.8.15; SOC 2 CC7.2) (12. Security) Colo: the provider's SOC 2 Type 2 report or ISO/IEC 27001 certificate, scoped to your site, as supplier evidence (ISO/IEC 27001 A.5.19 to A.5.22; SOC 2 CC9.2) (2. Site model) Restore tests recorded as evidence (ISO/IEC 27001 A.8.13; SOC 2 A1.3 when Availability is in scope) (11. Backup and DR) Change records with approvals (ISO/IEC 27001 A.8.32; SOC 2 CC8.1) (13. Ops and lifecycle) |
Governance: Frameworks compared |
| PCI DSS v4.0.1 cardholder data environment. You store, process or transmit cardholder data, or your systems can affect its security. Draw the CDE boundary before the segmentation model: whatever is not isolated from the CDE is in scope. Validated every year by a Report on Compliance or a Self-Assessment Questionnaire, as your acquirer or the card brands require. | Both | CDE as its own zone with inbound and outbound traffic limited to what is necessary (Req. 1.3.1, 1.3.2); segmentation pen test every 12 months and after changes (Req. 11.4.5) (12. Security) Where the CDE boundary and its inspection point sit in the fabric; any isolation method works if it passes the segmentation test (Req. 11.4.5) (8. DC fabric) Retention minimums: audit logs 12 months with the latest 3 immediately available (Req. 10.5.1); camera or access-control data and visitor logs 3 months (Req. 9.2.1.1, 9.3.4) (12. Security) Stored PAN unreadable (Req. 3.5.1); disk-level encryption alone suffices only on removable media (Req. 3.5.1.2); key management (Req. 3.6.1 and the 3.7 requirements) (10. Storage) Offline backup media in a secure location, reviewed every 12 months (Req. 9.4.1.1, 9.4.1.2) (11. Backup and DR) Alerts on failed critical controls, including physical access, segmentation and audit logging (Req. 10.7.2); scope confirmed every 12 months (Req. 12.5.2) (13. Ops and lifecycle) Colo: written agreement, yearly check of the provider's PCI DSS status and a responsibility matrix (Req. 12.8.2, 12.8.4, 12.8.5). A SOC 2 report is not an AOC for Req. 9 controls the provider runs (2. Site model) |
Governance: Design mapping: what frameworks require of the DC | |
| HIPAA Security Rule: systems holding ePHI. You are a covered entity or business associate and the DC holds electronic protected health information. Under the current rule many specifications are addressable: implement them, or document why an alternative is reasonable. Proposed amendments (90 FR 898, January 2025) would make more of them required; none is in force as of 6 Oct 2026. | Both | Data backup and disaster recovery plans are required; testing and revision are addressable (45 CFR 164.308(a)(7)). The proposed rule adds a 72-hour restore; verify status (11. Backup and DR) Encryption at rest and in transit is addressable today (164.312(a)(2)(iv), (e)(2)(ii)); record the decision. The proposed rule would require it; verify status (10. Storage) Audit controls on ePHI systems (164.312(b)) and facility access controls (164.310(a)(1)) (12. Security) Disposal and media re-use procedures, both required, at refresh and decommissioning (164.310(d)(2)(i), (ii)) (13. Ops and lifecycle) Colo: decide with counsel whether the provider needs a business associate agreement (164.308(b)) (2. Site model) Security policies, procedures and the documented actions and assessments they require, kept 6 years (164.316(b)) |
Governance: Design mapping: what frameworks require of the DC | |
| CMMC Level 2: CUI under NIST SP 800-171 Rev. 2. You are a defense contractor or subcontractor and the DC holds controlled unclassified information. Draw the CUI enclave and categorize assets per 32 CFR 170.19. Level 2 uses SP 800-171 Rev. 2 IDs, not Rev. 3. Phase 2 was suspended on 13 Jul 2026, so solicitations currently designate only Level 1 or Level 2 self-assessment; verify before you plan an assessment. | Both | CUI enclave boundary monitored and controlled, with publicly accessible components on separate subnetworks (3.13.1, 3.13.5) (12. Security) FIPS-validated cryptography wherever cryptography protects CUI (3.13.11); CUI protected at rest (3.13.16) (10. Storage) Backup copies of CUI protected where they are stored (3.8.9) (11. Backup and DR) Audit logs kept for a period you define (3.3.1) with synchronized time (3.3.7); physical access logs (3.10.4) (12. Security) Changes tracked, approved and logged (3.4.3); media sanitized or destroyed before disposal or reuse (3.8.3) (13. Ops and lifecycle) Colo: an External Service Provider only if CUI or security protection data sits on its assets (32 CFR 170.19); record the decision in the SSP and confirm with your assessor (2. Site model) |
Governance: Design mapping: what frameworks require of the DC | |
| Not confirmed yet. No one has confirmed which frameworks apply. Design to the general posture, but treat the segmentation model and retention periods as provisional: both are expensive to change once the fabric and storage are built. Available when you choose: not (General enterprise posture (ISO/IEC 27001 or SOC 2) or PCI DSS v4.0.1 cardholder data environment or HIPAA Security Rule: systems holding ePHI or CMMC Level 2: CUI under NIST SP 800-171 Rev. 2). |
Both | A scope statement is still owed: frameworks, systems and data in scope, and who confirmed them Segmentation model and retention periods stay provisional until scope is confirmed (12. Security) |
Governance: Set compliance scope early |
Step 2
Site model
Onsite room, retail colo or wholesale colo for the primary site, and where the DR target lives. This choice sets the onsite or colo path for the rest of the journey. Hybrid (an onsite room plus a colo cage for tier-1 apps) is chosen in the resilience step.
| Constrained by | 1. Requirements and capacity envelope |
| Locks in | Who owns power, cooling and physical security (4. Power); Carrier options (7. Carrier, edge and WAN); Staffing model and reliance on remote hands (13. Ops and lifecycle); Capex vs opex mix; Which side of the A9 availability gap you start on (3. Resilience and facility rating) |
| Onsite room | You build the room; typically N+1 with single points of failure. Accept the gap, invest to close it, or move tier-1 workloads to colo or DR (A9). |
| Colocation | You choose a provider and contract a TIA-942 Rated-3 / Uptime Tier III-class facility, backed by evidence and SLA terms. |
| Detail | Facility: Site model · Governance: Colo shared responsibility · Governance: Using a colo provider’s SOC 2 Type 2 report |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Where does the primary DC live? Choose one. Facility: Site model | Onsite room or building. You design, build, maintain and operate the room, its plant and its physical security. | Both | Capex for the room and plant; facilities staff or maintenance contracts (13. Ops and lifecycle) Building entrances and carrier laterals you provide (7. Carrier, edge and WAN) |
Facility: Options |
| Retail colo (cabinets or cage). The provider runs the plant and building security; you run your cabinets or cage on standardized terms. | Both | Remote hands for physical tasks (13. Ops and lifecycle) Cross connects to carriers and cloud on-ramps; wide choice only if carrier-neutral (7. Carrier, edge and WAN) Cage fit-out within provider rules (6. Racks, layout and cabling plant) |
Facility: Retail vs wholesale terms | |
| Wholesale colo (dedicated suite). The provider runs the plant; you take a dedicated suite on negotiated terms and often run more of its fit-out and operations. | Both | Remote hands for physical tasks (13. Ops and lifecycle) Cross connects, plus dedicated conduits or a private MMR where offered (7. Carrier, edge and WAN) Suite fit-out within provider rules (6. Racks, layout and cabling plant) |
Facility: Retail vs wholesale terms | |
| Where is the DR target? Choose one. Facility: DR location | Second colo. A second contracted facility, checked for shared utility, flood, seismic and carrier-route risk with the primary. Rate it so it is up when the primary is down; a DR site with the primary's single points of failure gives less cover than its distance suggests. | Both | DCI circuits (7. Carrier, edge and WAN) Multi-site overlay design (RFC 9014 gateway model) (8. DC fabric) Replication with the same array, hypervisor or application method as the primary (11. Backup and DR) |
Facility: DR location |
| Cloud region. Standby capacity at a cloud provider; you rely on its published regional design and service SLAs, not a facility rating. | Both | Cloud on-ramp or VPN instead of DCI circuits (7. Carrier, edge and WAN) Replication into the provider’s format; failback includes data egress (11. Backup and DR) |
Facility: DR location |
Step 3
Resilience and facility rating
Choose the redundancy level and rating to design or contract against. Onsite, decide how to handle the availability gap (A9); in colo, verify the contracted rating.
| Constrained by | 1. Requirements and capacity envelope, 2. Site model, A9 |
| Locks in | Power topology (4. Power); Cooling topology (5. Cooling); Colo SLA terms; Where tier-1 workloads run (9. Compute platform); How much DR must cover for facility outages (11. Backup and DR) |
| Onsite room | A typical mid-size room is N+1 with single points of failure. Accept the gap, invest to close it, or place tier-1 workloads in colo or DR. |
| Colocation | Contract a Rated-3 / Tier III-class facility and verify that the rating is backed by evidence and SLA terms. |
| Detail | Facility: Resilience & facility rating |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| What level do you design or contract against? Choose one. Facility: Rating schemes compared | N+1 components, single path (level 2). Survives the failure or removal of one component. Work on a shared path element needs an outage window, and a fault on one drops load. | Onsite room | Planned outages for path maintenance (13. Ops and lifecycle) DR has to cover a full facility outage (11. Backup and DR) |
Facility: Redundancy: components vs paths |
| Concurrently maintainable design intent (level 3). A second distribution path lets planned work proceed without an outage; a fault during maintenance can still drop load. | Both | Onsite: a second distribution path for power. Colo: A/B feeds to every rack (4. Power) Onsite: a second distribution path for cooling (5. Cooling) Dual-corded IT (6. Racks, layout and cabling plant) |
Facility: Concurrent maintainability vs fault tolerance | |
| Fault-tolerant design intent (level 4). Above this scenario's A9 colo target. Two active, separated paths survive any single unplanned fault, including a fault on a path. | Both | Onsite: 2N or 2(N+1) power on active, separated paths. Colo: contract and verify level-4 evidence (4. Power) Onsite: active, separated cooling paths (5. Cooling) Dual-corded IT (6. Racks, layout and cabling plant) |
Facility: Concurrent maintainability vs fault tolerance | |
| Onsite: how do you handle the availability gap? Choose one. Facility: Decision point: the onsite availability gap | Accept N+1 with known single points of failure. Document every single point of failure, agree maintenance windows with the business, and make DR cover a full facility outage. Available when you choose: N+1 components, single path (level 2). |
Onsite room | How much DR must cover (11. Backup and DR) Maintenance windows (13. Ops and lifecycle) |
Facility: Decision point: the onsite availability gap |
| Invest to close the gap. Add a second distribution path for power and cooling (two active, separated paths for level 4), treat on-site generation as the primary source, and dual-cord the IT. Describe the result as design intent, or certify it (Uptime TCDD then TCCF, or TIA-942 Design then Facilities). Available when you choose: Concurrently maintainable design intent (level 3) or Fault-tolerant design intent (level 4). |
Onsite room | Power topology (4. Power) Cooling topology (5. Cooling) Dual-corded IT and rack PDU choices (6. Racks, layout and cabling plant) |
Facility: Decision point: the onsite availability gap | |
| Place tier-1 workloads in colo or DR. Keep the onsite room for workloads that tolerate planned outages, and run tier-1 apps in a contracted Rated-3 / Tier III-class colo or an active DR site. This makes the design hybrid. Available when you choose: N+1 components, single path (level 2). |
Onsite room | DCI between the sites (7. Carrier, edge and WAN) Replication between the sites (11. Backup and DR) Where tier-1 workloads run (9. Compute platform) Colo evaluation, contracted kW and SLA for the tier-1 cage |
Facility: Decision point: the onsite availability gap | |
| How do you verify a contracted colo rating? Choose any that apply. Facility: Colo evaluation | Current certificate for your building or hall. Check it against the issuer’s records; a design-only certificate does not prove the build. Available when you choose: Retail colo (cabinets or cage) or Wholesale colo (dedicated suite) or Place tier-1 workloads in colo or DR or Second colo. |
Both | — | Facility: Evidence for a claimed rating |
| SLA terms that match the rating. Check that maintenance is not excluded from measurement, the grid exclusions, the dual-feed definition and the remedy cap. Available when you choose: Retail colo (cabinets or cage) or Wholesale colo (dedicated suite) or Place tier-1 workloads in colo or DR or Second colo. |
Both | — | Facility: Reading the SLA | |
| Operations evidence. Ask for TCOS or an M&O Stamp, or the provider’s maintenance and incident history for the hall. Available when you choose: Retail colo (cabinets or cage) or Wholesale colo (dedicated suite) or Place tier-1 workloads in colo or DR or Second colo. |
Both | — | Facility: Operations matter as much as topology |
Step 4
Power
Onsite, the full chain from utility to rack PDU. In colo, contracted kW per cabinet or cage on A/B feeds, plus your own rack PDUs.
| Constrained by | 1. Requirements and capacity envelope, 3. Resilience and facility rating |
| Locks in | Maximum rack density (5. Cooling); Cooling load (5. Cooling); Rack PDU form factor (6. Racks, layout and cabling plant) |
| Onsite room | Full power chain: utility/MV, UPS, generator, distribution to the rack PDU. |
| Colocation | Rack PDUs plus contracted kW and A/B feeds. |
| Detail | Power: What it is |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| What power chain do you design? Choose one. Power: What it is | Full chain (utility/MV, UPS, generator, distribution). You design, build and maintain every stage from utility service to rack PDU. | Onsite room | Generator testing, fuel quality and UPS battery trending (13. Ops and lifecycle) UPS, generator and switchgear controllers in the OT power zone (12. Security) |
Power |
| Contracted kW on A/B feeds. The provider runs the chain; you contract capacity per cabinet or cage, size A/B on the surviving feed, and supply the rack PDUs. | Colocation | Rack PDU input plug must match the provider’s receptacle (6. Racks, layout and cabling plant) Provider power readings only through its portal or API, if offered (13. Ops and lifecycle) |
Power: Colo power: contracted kW and A/B feeds | |
| Onsite: what redundancy does the power chain carry? Choose one. Facility: Redundancy: components vs paths | N+1 components, single path. Spare UPS modules or generators on one distribution path; matches a level-2 target. Available when you choose: N+1 components, single path (level 2). |
Onsite room | — | Facility: Redundancy: components vs paths |
| N+1 components, two paths (one active). A second distribution path allows planned work without an outage; matches a level-3 target. Available when you choose: Concurrently maintainable design intent (level 3). |
Onsite room | Dual-corded IT on A and B rack PDUs (6. Racks, layout and cabling plant) | Facility: Redundancy: components vs paths | |
| 2N or 2(N+1), two active paths. Duplicates each system on separated, active paths; matches a level-4 target. Available when you choose: Fault-tolerant design intent (level 4). |
Onsite room | Dual-corded IT on A and B rack PDUs (6. Racks, layout and cabling plant) | Facility: Redundancy: components vs paths | |
| Which rack PDU type? Choose one. Power: Rack PDUs and A/B feeds | Metered. Shows load on a local display; no network readings. | Both | — | Power: Rack PDUs and A/B feeds |
| Monitored. Reports input readings over the network. | Both | Management ports and addresses on the OOB network (8. DC fabric) | Power: Rack PDUs and A/B feeds | |
| Switched. Adds remote outlet on/off control over the network. | Both | Management ports and addresses on the OOB network (8. DC fabric) | Power: Rack PDUs and A/B feeds | |
| Outlet-metered. Reports readings per outlet over the network. | Both | Management ports and addresses on the OOB network (8. DC fabric) | Power: Rack PDUs and A/B feeds | |
| Where do power-device management ports go? Choose any that apply. Power: Power networking: PDU, UPS, and EPMS connectivity | Rack-side devices on the OOB network. Rack PDUs, rack transfer switches and UPS cards that feed only IT racks go on the out-of-band network. | Both | OOB switch ports and static addresses per rack, after chaining (8. DC fabric) | Power: Power networking: PDU, UPS, and EPMS connectivity |
| Facility power plant in the OT power zone. Switchgear, generator controls and facility UPS cards sit in the OT power zone behind its conduit rules. | Onsite room | OT power zone and its conduits (12. Security) EPMS collection (13. Ops and lifecycle) |
Security: PDU and UPS cards: OOB or OT zone | |
| Provider portal or API for facility power data. Provider UPS and EPMS data comes only through the provider’s portal or API, if one is offered. | Colocation | Provider portal in the monitoring toolset (13. Ops and lifecycle) | Power: Power networking: PDU, UPS, and EPMS connectivity |
Step 5
Cooling
Onsite, the plant, containment and controls. In colo, the provider’s density ceiling, containment rules and liquid offering.
| Constrained by | 1. Requirements and capacity envelope, 3. Resilience and facility rating, 4. Power |
| Locks in | Density ceiling (6. Racks, layout and cabling plant); Rack layout and containment (6. Racks, layout and cabling plant); Future AI readiness |
| Onsite room | You design and operate the cooling plant. |
| Colocation | Provider plant; you follow its containment and density rules. |
| Detail | Cooling: Cooling decisions at a glance |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| What plant rejects the heat? Choose one. Cooling: Cooling decisions at a glance | DX CRACs. Direct-expansion units, each with its own compressor, perimeter or in-row. | Onsite room | — | Cooling: Air cooling |
| Chilled-water plant with CRAHs. Chillers, towers or dry coolers and pumps serve chilled-water coil units; warmer water gives more economizer hours. | Onsite room | Chiller and CRAH controls integrated with the BMS (13. Ops and lifecycle) | Cooling: Chilled water plant | |
| Provider’s plant. Confirm the cooling ceiling per cabinet and cage, and the inlet temperature SLA. | Colocation | — | Cooling: Colocation cooling limits | |
| Which containment? Choose one. Cooling: Containment and airflow management | Hot-aisle containment (HACS). Encloses the hot aisle and ducts its exhaust to a plenum or in-row coolers; the room stays at supply temperature. | Onsite room | Row orientation and aisle layout (6. Racks, layout and cabling plant) Switch fan and PSU airflow direction to match the rows (8. DC fabric) Containment method checked against fire detection and suppression (13. Ops and lifecycle) |
Cooling: Containment and airflow management |
| Cold-aisle containment (CACS). Encloses the cold aisle with doors and a roof; often simpler to retrofit over a raised floor, but the open room runs hot. | Onsite room | Row orientation and aisle layout (6. Racks, layout and cabling plant) Switch fan and PSU airflow direction to match the rows (8. DC fabric) Containment method checked against fire detection and suppression (13. Ops and lifecycle) |
Cooling: Containment and airflow management | |
| Provider’s containment and blanking rules. Follow the provider’s containment, blanking and airflow-direction rules; containment can be mandatory from day one. | Colocation | Cage fit-out to the provider’s containment scheme (6. Racks, layout and cabling plant) Switch fan and PSU airflow direction to match the rows (8. DC fabric) |
Cooling: Colocation cooling limits | |
| Liquid now or later? Choose one. Cooling: Rear-door and liquid cooling | Air only. Air cooling with no provisions for adding liquid later. | Both | — | Cooling: Air cooling |
| Air now, liquid-ready. Provision tap-offs, CDU floor space, pipe routes and leak detection for a future liquid zone. | Onsite room | Overhead pipe routes coordinated with cable pathways (6. Racks, layout and cabling plant) Leak-detection points in the BMS points list (13. Ops and lifecycle) |
Cooling: Liquid-ready design | |
| Rear-door or in-row coolers. Liquid to a coil at the rack or row; servers stay air-cooled. | Onsite room | Water piping to the rack or row (6. Racks, layout and cabling plant) | Cooling: Rear-door and liquid cooling | |
| Provider’s liquid offering. Confirm whether the site offers rear doors, in-row coolers or liquid to the cage, and where the demarcation sits. | Colocation | — | Cooling: Colocation cooling limits | |
| How are the cooling controls connected? Choose one. Cooling: Cooling controls and connectivity | Integrated with your BMS. CRAHs, chillers, CDUs and leak-detection panels report to your BMS and keep running on local control if it fails. | Onsite room | Plant controllers in the OT mechanical zone (12. Security) BMS platform (13. Ops and lifecycle) |
Cooling: Cooling controls and connectivity |
| Provider portal or API. Cooling telemetry comes from the provider; your own CDUs and sensors need their own connectivity in the cage. | Colocation | Provider portal in the monitoring toolset (13. Ops and lifecycle) | Cooling: Cooling controls and connectivity |
Step 6
Racks, layout and cabling plant
Cabinet size, row layout, switch placement, pathways and the structured cabling plant; in colo, the cage fit-out within provider rules.
| Constrained by | 4. Power, 5. Cooling |
| Locks in | Cable lengths, which drive the optics choice (8. DC fabric); Switch placement (8. DC fabric) |
| Onsite room | Free layout choice. |
| Colocation | Cage fit-out within provider rules. |
| Detail | Racks: Rows, aisles & switch placement · Racks: Cabinets & frames · Racks: Structured cabling plant · Racks: Colo cage fit-out |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Which cabinet height? Choose one. Racks: Height, width and depth | 42U. The common height; fewer U, cables and heat per cabinet. | Both | — | Racks: Height, width and depth |
| 48U. More U per footprint, but more cable and heat per cabinet; check ceiling, tray, sprinkler, door and lift clearances and any colo height limit. | Both | — | Racks: Height, width and depth | |
| Which server cabinet width? Choose one. Racks: Height, width and depth | 600 mm. Saves row length. | Both | — | Racks: Height, width and depth |
| 800 mm. Leaves side space for vertical managers and 0U PDUs, which matters with many cables per cabinet. | Both | — | Racks: Height, width and depth | |
| Where do the switches sit? Choose one. Racks: ToR, MoR, EoR or centralized | Top of rack (ToR). Server cables stay in the cabinet; horizontal runs become a few fiber uplinks per cabinet. | Both | Leaf switches in every cabinet (8. DC fabric) | Racks: ToR, MoR, EoR or centralized |
| Middle of row (MoR). Server cables run to a switch cabinet mid-row, with heavy tray load either side of it. | Both | Cross-cabinet server links; check DAC reach at the next lane rate (8. DC fabric) | Racks: ToR, MoR, EoR or centralized | |
| End of row (EoR). Server cables run to switch cabinets at the row end: more and longer horizontal runs, with ports and patching concentrated. | Both | Cross-cabinet server links; check DAC reach at the next lane rate (8. DC fabric) | Racks: ToR, MoR, EoR or centralized | |
| Centralized. All horizontal cabling runs to one switching area; simple to manage, but scales poorly. Small rooms only. | Both | — | Racks: ToR, MoR, EoR or centralized | |
| Overhead or underfloor pathways? Choose one. Racks: Pathways & separation | Overhead. Keeps the supply plenum clear and is easy to audit; competes with lighting, sprinklers, containment roofs and busway. | Both | — | Racks: Overhead vs underfloor |
| Underfloor. Uses the raised floor; cable bundles block underfloor air and abandoned cable accumulates unseen. | Both | — | Racks: Overhead vs underfloor |
Step 7
Carrier, edge and WAN
Carrier diversity, the internet edge, cross connects, DCI to the DR site and the SD-WAN hub.
| Constrained by | 2. Site model, 3. Resilience and facility rating, A2, A3, A9 |
| Locks in | Edge security placement (12. Security); DCI capacity caps the RPO that replication can hold (11. Backup and DR); Border-leaf ports and VRF handoffs for edge routers, firewalls and the WAN hub (8. DC fabric) |
| Sketch early | From 11. Backup and DR: DCI bandwidth is sized from the RPO and data change rate in Backup and DR. Draft them per tier before ordering circuits. |
| Onsite room | Carrier entries and building diversity. |
| Colocation | MMR cross connects, carrier-neutral choice, cloud on-ramps. |
| Detail | Network: Edge & carrier · Network: DCI to the DR site · Network: DDoS scrubbing: diversion and return path · Network: Market leaders & comparison — SD-WAN |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| How do carriers reach the site? Choose one. Network: Edge & carrier | Two diverse building entrances. You provide two entrance pathways and carriers build laterals to them; the construction and its lead time are yours. | Onsite room | — | Network: Edge & carrier |
| Cross connects from the meet-me room. Order cross connects against each carrier’s LOA, and get diverse routing for redundant cross connects in writing. | Colocation | Demarc panel in the cage sized for the expected cross connects (6. Racks, layout and cabling plant) | Network: Edge & carrier | |
| Whose address space does the internet edge announce? Choose one. Network: Edge & carrier | Own ASN and provider-independent space. Two edge routers run eBGP to both carriers and announce your own prefixes; RIR allocation takes time. | Both | At least a /24 (IPv4) that a scrubbing provider can announce, with ROAs and IRR entries (12. Security) | Network: Edge & carrier |
| Carrier-assigned space. Use each carrier's addresses. Inbound failover between carriers then relies on DNS or NAT rather than BGP, and BGP-diverted DDoS scrubbing needs a prefix you can authorize. | Both | — | Network: Edge & carrier | |
| How do you reach the DR site? Choose any that apply. Network: DCI to the DR site | L2 transport: dark fibre, wavelength or carrier Ethernet. Point-to-point links to a second colo; encrypt per hop with MACsec where the carrier service passes it. Available when you choose: Second colo or Place tier-1 workloads in colo or DR. |
Both | DCI bandwidth from the replication requirement, plus resync headroom (11. Backup and DR) Gateway model at each site (RFC 9014) rather than one stretched L2/EVPN domain (8. DC fabric) |
Network: DCI to the DR site |
| L3 transport: IP VPN, internet IPsec or SD-WAN. Routed transport to the DR site, encrypted with IPsec. | Both | DCI bandwidth from the replication requirement, plus resync headroom (11. Backup and DR) | Network: DCI to the DR site | |
| Cloud on-ramp. Dedicated or partner interconnect to the cloud provider, on separate customer devices, with each link sized to carry the full load alone. Available when you choose: Cloud region. |
Both | DCI bandwidth from the replication requirement, plus resync headroom (11. Backup and DR) | Network: Edge & carrier | |
| How do the branches reach the DC? Choose one. Network: WAN design: SD-WAN hub, carrier MPLS, hybrid | SD-WAN hub in the DC. Hub or aggregation gateways in the DC terminate branch tunnels and peer with the fabric. | Both | SSE or single-vendor SASE for remote access (12. Security) | Network: WAN design: SD-WAN hub, carrier MPLS, hybrid |
| Carrier MPLS L3VPN. Branches reach the DC over a carrier-managed MPLS VPN through CE routers, without an SD-WAN overlay; the carrier SLA covers transport, and you get no per-application path steering. | Both | — | Network: WAN design: SD-WAN hub, carrier MPLS, hybrid |
Step 8
DC fabric
Spine-leaf size, underlay, overlay, dual-homing, firewall insertion and out-of-band management.
| Constrained by | 1. Requirements and capacity envelope, 6. Racks, layout and cabling plant, 7. Carrier, edge and WAN, A5, A6, A7 |
| Locks in | Port speeds and NICs for compute, set by the leaf downlink speed per role (9. Compute platform); Port speeds and storage paths (10. Storage); Multi-site design (11. Backup and DR) |
| Sketch early | From 12. Security: VRF layout and firewall insertion follow the segmentation model in Security. Draft it before building the overlay. |
| Onsite room | OOB shortens recovery; your staff do the physical work. |
| Colocation | Console and OOB to every device is the main recovery path; keep remote hands for hardware and cabling. |
| Detail | Network: Fabric design · Network: EVPN/VXLAN · Network: EVPN multihoming vs MLAG · Network: MTU and VXLAN overhead · Network: Out-of-band management · Network: Firewall and service insertion |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| How many Clos stages? Choose one. Network: Fabric design | 3-stage (leaf and spine). Spine radix sets the leaf ceiling. | Both | — | Network: Fabric design |
| 5-stage (leaf, spine and super-spine). Adds a super-spine tier; super-spine radix sets the POD ceiling. | Both | — | Network: Fabric design | |
| Leaf downlink speed per leaf role Choose any that apply. Network: Oversubscription | 25G host ports, 100G uplinks. Matches 2 × 25GbE hosts; the page's example (48 × 25G down, 8 × 100G up) is 1.5:1. | Both | Host NIC speed: 25GbE (9. Compute platform) | Network: Oversubscription |
| 100G host ports. For hosts carrying IP storage or HCI traffic on shared ports; set the ratio per leaf role from Storage's target. | Both | Host NIC speed: 100GbE (9. Compute platform) | Network: Oversubscription | |
| Which underlay routing? Choose one. Network: Fabric design | eBGP underlay (RFC 7938). Strongest failure isolation and scales furthest; needs an ASN plan (shared spine ASN, unique 4-byte private ASN per leaf or leaf pair) and multipath-relax. | Both | — | Network: Fabric design |
| IS-IS or OSPF underlay. Familiar to operators, native ECMP and a clean underlay/overlay split; with EVPN, iBGP to spine route reflectors. Flooding grows in dense Clos. | Both | — | Network: Fabric design | |
| Which overlay? Choose one. Network: EVPN/VXLAN | EVPN/VXLAN. Symmetric IRB with a distributed anycast gateway and one L3 VNI per tenant VRF. | Both | Hosts set the agreed tenant MTU; the underlay carries VXLAN overhead (9. Compute platform) | Network: EVPN/VXLAN |
| Routed to the leaf, no overlay (RFC 7938). Each subnet ends at its leaf or leaf pair, so no VLAN spans racks. Simplest fabric, but VM mobility and anything that needs L2 adjacency stays within one leaf pair. | Both | Workloads needing L2 adjacency stay within one leaf pair (9. Compute platform) Zone VRFs need VRF-lite with per-VRF subinterfaces and peering on every fabric link (12. Security) |
Network: Routed to the leaf, no overlay | |
| How are hosts and appliances dual-homed? Choose any that apply. Network: EVPN multihoming vs MLAG | EVPN all-active multihoming (ESI). Mass withdrawal and aliasing on link failure; fix the DF election algorithm per segment. Available when you choose: EVPN/VXLAN. |
Both | Host LACP bonds need the same ESI and LACP system ID on both leaves (9. Compute platform) | Network: EVPN multihoming vs MLAG |
| MLAG / vPC. Two leaves present one LACP partner to the host; single-homed ports on the pair can cross the peer link. | Both | Peer-link ports and cabling per leaf pair (6. Racks, layout and cabling plant) | Network: EVPN multihoming vs MLAG | |
| How do inspected flows reach the firewall? Choose one. Network: Firewall and service insertion | Routed per-VRF attachment. Each zone VRF defaults to the firewall at a border or service leaf; the simplest and most common model. | Both | Firewall sized for the inspected inter-zone load (12. Security) Service-leaf uplinks sized for the inspected inter-zone load (8. DC fabric) |
Network: Firewall and service insertion |
| Firewall as an EVPN VTEP. The firewall joins the overlay; its EVPN feature set and scale become part of the fabric design. Available when you choose: EVPN/VXLAN. |
Both | Firewall EVPN interoperability with the switch NOS (12. Security) | Network: Firewall and service insertion | |
| Policy-based redirect. Leaves redirect matching flows to a service node; the rules must keep both directions on the same node. | Both | Redirect rules reviewed for drift like ACLs (12. Security) | Network: Firewall and service insertion | |
| What goes into the out-of-band network? Choose any that apply. Network: Out-of-band management | Physically separate OOB network. Dedicated switches, addressing and routing, with AAA, NTP and DNS that do not depend on production. | Both | BMC ports on the OOB (9. Compute platform) Telemetry collection through one filtered conduit (13. Ops and lifecycle) |
Network: Out-of-band management |
| Console servers. Serial and USB console access to every network device and firewall; the only path after a bad config push. | Both | — | Network: Out-of-band management | |
| Cellular backup access. An LTE/5G path that shares no plant with the wired carriers; use a private APN or outbound-only VPN. Available when you choose: Physically separate OOB network or Console servers. |
Both | — | Network: Out-of-band management |
Step 9
Compute platform
3-tier vs HCI, then the host side of the server-to-leaf link: NIC speed and teaming.
| Constrained by | 1. Requirements and capacity envelope, 4. Power, 5. Cooling, 8. DC fabric, A7 |
| Locks in | Storage architecture (10. Storage); Licensing; Host networking |
| Detail | HCI: Choosing HCI, dHCI or 3-tier · Compute: Server networking · HCI: HCI network decisions |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Which compute platform? Choose one. HCI: Choosing HCI, dHCI or 3-tier | 3-tier: servers plus external storage. Servers and arrays scale separately under separate tools, with a storage network to the arrays. | Both | External arrays and a storage network (10. Storage) | HCI: Choosing HCI, dHCI or 3-tier |
| HCI appliance. Vendor-built nodes sold with the HCI software as one product, with one support path. | Both | Cluster replication and rebuild traffic on the fabric; check DCB or dedicated ToR requirements (8. DC fabric) | HCI: Appliance HCI | |
| Software HCI on certified nodes. HCI software licensed on its own and installed on servers from the vendor’s compatibility list. | Both | Cluster replication and rebuild traffic on the fabric; check DCB or dedicated ToR requirements (8. DC fabric) | HCI: Software HCI on certified nodes | |
| Disaggregated HCI (dHCI). The HCI control plane runs on compute nodes and data lives on external storage, so compute and capacity scale independently. | Both | A storage-protocol network to the arrays (10. Storage) | HCI: Disaggregated HCI (dHCI) | |
| What NIC layout per host? Choose one. Compute: NIC speed | 2 × 25GbE. A common starting point for a general VM host with FC or a separate storage path. | Both | — | Compute: NIC speed |
| 2 × 100GbE. A common starting point for a VM host carrying IP storage on the same ports. | Both | — | Compute: NIC speed | |
| 2 × 25GbE plus dedicated storage ports. Keeps IP storage on its own adapters, at the cost of more leaf ports and cables. | Both | — | Compute: NIC speed | |
| How do hosts team their uplinks? Choose one. Compute: Host bonding and LACP | LACP to the leaf pair. Per-flow hashing and fast detection of a mis-cabled member, but host and leaf configuration are tied together. Available when you choose: EVPN all-active multihoming (ESI) or MLAG / vPC. |
Both | Leaf-side LAGs for every host (8. DC fabric) Storage ports stay outside the LAG: one path per adapter for iSCSI/NVMe multipath (10. Storage) |
Compute: Host bonding and LACP |
| Switch-independent teaming. Nothing to configure on the leaf; each vNIC is pinned to one uplink and its MAC moves on failover. | Both | — | Compute: Host bonding and LACP |
Step 10
Storage
Block, file and object mix, the block transport, and whether the storage network is dedicated or converged on the fabric.
| Constrained by | 1. Requirements and capacity envelope, 9. Compute platform, 8. DC fabric |
| Locks in | Backup integration (11. Backup and DR); DR replication method (11. Backup and DR) |
| Detail | Storage: Storage networking · Storage: Block, file and object: when each fits |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Which access models do you need? Choose any that apply. Storage: Block, file and object: when each fits | Block. Volumes presented to a host or cluster; fits databases, hypervisor datastores and VDI. | Both | — | Storage: Block, file and object: when each fits |
| File. Shared namespace over NFS or SMB; fits user, home and application shares and VDI profiles. | Both | — | Storage: Block, file and object: when each fits | |
| Object. Flat namespace, usually S3-compatible; fits backup targets, logs and data lakes. | Both | Object Lock as a backup immutability option (11. Backup and DR) | Storage: Block, file and object: when each fits | |
| Which block transport to external arrays? Choose one. Storage: Protocol comparison | FC SAN (FCP or NVMe/FC). Dual A/B fabrics on their own switches, HBAs and FC skills. Available when you choose: 3-tier: servers plus external storage or Disaggregated HCI (dHCI). |
Both | — | Storage: FC SAN: dual fabrics, zoning and NVMe/FC access |
| iSCSI. Block over an ordinary IP network, with host multipathing on A/B paths. Available when you choose: 3-tier: servers plus external storage or Disaggregated HCI (dHCI). |
Both | — | Storage: IP SAN: iSCSI and NVMe/TCP | |
| NVMe/TCP. NVMe-oF over an ordinary IP network; plan discovery and host NQN authorization. Available when you choose: 3-tier: servers plus external storage or Disaggregated HCI (dHCI). |
Both | — | Storage: IP SAN: iSCSI and NVMe/TCP | |
| NVMe/RoCE. NVMe-oF over RDMA; needs a lossless Ethernet configuration. Available when you choose: 3-tier: servers plus external storage or Disaggregated HCI (dHCI). |
Both | PFC and ECN on the storage path (8. DC fabric) RoCE contained to dedicated switches or a small set of leaves; over VXLAN, inner-to-outer DSCP copy and DSCP-based PFC on every hop (8. DC fabric) |
Storage: NVMe/RoCE and lossless Ethernet | |
| Dedicated or converged storage network? Choose one. Storage: Dedicated vs converged | Converged on the DC fabric. Fewest switches and one toolset; storage shares the LAN’s fault domain and needs a QoS class and low oversubscription on storage paths. Available when you choose: (3-tier: servers plus external storage or Disaggregated HCI (dHCI)) and (not FC SAN (FCP or NVMe/FC)). |
Both | Storage QoS class and oversubscription target on the shared fabric (8. DC fabric) | Storage: Dedicated vs converged |
| Dedicated IP SAN switches. Separate A and B Ethernet domains sized for storage only, with the same Ethernet skills. Available when you choose: (3-tier: servers plus external storage or Disaggregated HCI (dHCI)) and (not FC SAN (FCP or NVMe/FC)). |
Both | — | Storage: Dedicated vs converged | |
| Separate FC fabrics. Native FC always runs on its own A and B switches. Available when you choose: FC SAN (FCP or NVMe/FC). |
Both | — | Storage: Dedicated vs converged |
Step 11
Backup and DR
Backup platform and targets, immutability, DR replication and the vault, plus the replication bandwidth that sizes the DCI.
| Constrained by | 1. Requirements and capacity envelope, 2. Site model, 7. Carrier, edge and WAN, 10. Storage |
| Locks in | DR link sizing (7. Carrier, edge and WAN); Restore testing (13. Ops and lifecycle) |
| Detail | Backup: Backup network decisions · Backup: RPO, RTO and copy strategy · Backup: Replication bandwidth from RPO · Backup: DR design |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Which delivery model? Choose one. Backup: Backup platforms and targets | Software on your hardware. Backup server, proxies and repositories on servers and storage you choose; you harden the repository. | Both | — | Backup: Delivery models |
| Integrated appliance. A purpose-built target with software; fewer parts, with capacity and refresh tied to one vendor. | Both | — | Backup: Delivery models | |
| Scale-out secondary platform. One cluster is both software and target; a larger blast radius if its admin plane is compromised. | Both | — | Backup: Delivery models | |
| SaaS-managed control plane. Little local infrastructure; restore speed is bound by the WAN, and sovereignty and exit terms need checking. | Both | — | Backup: Delivery models | |
| Which targets hold the copies? Choose any that apply. Backup: Targets: disk, object, tape | Dedupe disk appliance. Vendor retention lock; short and medium retention with fast operational restores. | Both | — | Backup: Targets: disk, object, tape |
| Hardened Linux repository. Immutable disk copies on general-purpose servers, using a filesystem attribute set by the backup software. | Both | — | Backup: Targets: disk, object, tape | |
| S3-compatible object with Object Lock. Scale-out capacity tier, offsite or cloud copy. | Both | — | Backup: Targets: disk, object, tape | |
| Tape (LTO). Offline once ejected; for offline copies, long retention and archive. | Both | — | Backup: Targets: disk, object, tape | |
| Which layers replicate to DR? Choose any that apply. Backup: Replication types | Array replication. Sync within a distance limit, or async; independent of hypervisor and OS. With a cloud DR target it needs the same array OS running in the cloud region, so check vendor support. Available when you choose: 3-tier: servers plus external storage or Disaggregated HCI (dHCI). |
Both | DCI bandwidth from the replication requirement, plus resync headroom (7. Carrier, edge and WAN) | Backup: Replication types |
| Hypervisor replication. Interval-based async per VM; storage-agnostic. | Both | DCI bandwidth from the replication requirement, plus resync headroom (7. Carrier, edge and WAN) | Backup: Replication types | |
| Journal-based CDP. Seconds of RPO while the link keeps up; the journal allows rollback to before a corruption. | Both | DCI bandwidth from the replication requirement, plus resync headroom (7. Carrier, edge and WAN) | Backup: Replication types | |
| Application replication. Sync commit adds latency; async suits distance but a forced failover may lose data. | Both | DCI bandwidth from the replication requirement, plus resync headroom (7. Carrier, edge and WAN) | Backup: Replication types | |
| Which vault for the cyber-recovery copy? Choose one. Backup: Vault air gap | Offline media. A physical air gap: ejected tape, with custody, transport and read-back tests. | Both | — | Backup: Vault air gap |
| On-prem isolated vault. A logical air gap: the vault pulls over a dedicated link and firewall it opens only for the sync window. | Both | Dedicated vault replication link and firewall, with no route to production or OOB (12. Security) | Backup: Vault air gap | |
| Managed or cloud vault service. A logical air gap run by the provider; check who can delete copies, restore speed and exit terms. | Both | Outbound path to the vault service through the edge (7. Carrier, edge and WAN) | Backup: Vault air gap |
Step 12
Security
Perimeter firewall, segmentation model, remote user access, identity and PAM, OT/facility isolation and physical security.
| Constrained by | 1. Requirements and capacity envelope, 7. Carrier, edge and WAN, 8. DC fabric, A4, A11 |
| Locks in | Policy model: zone-to-VRF mapping, inspected boundaries and insertion points (8. DC fabric); Logging volume (13. Ops and lifecycle) |
| Detail | Security: Perimeter: NGFW pair, HMF and sizing · Security: Segmentation and microsegmentation · Security: Policy model · Security: Remote access: ZTNA, SSE, SASE · Security: Identity and PAM for infrastructure · Security: OT / facility network security · Security: Physical security · Governance: Design mapping: what frameworks require of the DC |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| What enforces the perimeter? Choose one. Security: Perimeter: NGFW pair, HMF and sizing | On-prem NGFW pair. A firewall pair behind the edge routers inspects the internet, DMZ and inter-zone boundaries. | Both | — | Security: Perimeter: NGFW pair, HMF and sizing |
| Hybrid mesh firewall. Physical, virtual and cloud firewalls managed as one policy. | Both | — | Security: Hybrid mesh firewall | |
| Where is microsegmentation enforced? Choose any that apply. Security: Segmentation and microsegmentation | Network-based. Firewalls, routers and switch ACLs; works for legacy, appliances and OT, but is coarse without group-based policy. | Both | — | Security: Enforcement types |
| Host agent. A host firewall managed by an agent; fine-grained, but needs an agent on every endpoint. | Both | — | Security: Enforcement types | |
| Hypervisor-based. Enforced at the vNIC with no guest agent; tied to one hypervisor and does not cover bare metal. | Both | — | Security: Enforcement types | |
| Container. Orchestrator network policy or service mesh; covers only that platform. | Both | — | Security: Enforcement types | |
| How do remote users reach applications? Choose one. Security: Remote access: ZTNA, SSE, SASE | ZTNA within an SSE service. Per-application sessions through connectors that open outbound to the broker; SD-WAN stays separate. | Both | ZTNA connectors in a dedicated DMZ segment (8. DC fabric) | Security: SSE or SASE, one vendor or two |
| Single-vendor SASE. SSE plus the SD-WAN from one vendor: one policy and one console for transport and security. Available when you choose: SD-WAN hub in the DC. |
Both | ZTNA connectors in a dedicated DMZ segment (8. DC fabric) | Security: SSE or SASE, one vendor or two | |
| Remote-access VPN. A network path into one or more subnets through an internet-facing gateway. | Both | — | Security: Retiring VPN | |
| How is volumetric DDoS handled? Choose one. Security: DDoS | Carrier-provided mitigation. Filters in each carrier’s network per circuit; with two carriers, each protects only its own circuit. | Both | — | Security: DDoS |
| Cloud scrubbing, always-on. All traffic passes through the provider; no diversion delay, but an extra path and dependency in normal service. | Both | — | Security: DDoS | |
| Cloud scrubbing, on-demand. Traffic is diverted during an attack, usually by BGP, and returns over a tunnel. | Both | An announceable prefix and a GRE return path with an MSS clamp (7. Carrier, edge and WAN) | Security: DDoS | |
| Remotely triggered blackhole. The carrier drops traffic to one prefix, signalled with the BLACKHOLE community. | Both | — | Security: DDoS | |
| How are administrators controlled? Choose any that apply. Security: Identity and PAM for infrastructure | Separate admin identities. Infrastructure identities apart from workforce accounts, with the most privileged tier kept apart. | Both | — | Security: Separate admin identities |
| PAM with jump hosts on the OOB. Vaulted credentials, recorded sessions and just-in-time elevation. | Both | Jump hosts on the OOB network (8. DC fabric) | Security: PAM | |
| Phishing-resistant MFA. For administrator access to infrastructure. | Both | — | Security: Phishing-resistant MFA | |
| How is the facility (OT) network isolated? Choose one. Security: OT / facility network security | OT zones and conduits with an IT/OT DMZ. BMS, EPMS, generator and cooling controls, PACS and VMS in OT zones behind a firewall and DMZ. | Onsite room | Collectors in the monitoring DMZ (13. Ops and lifecycle) | Security: Zones and conduits |
| Your in-cage devices only. Only your own devices in the cage are yours to place; provider facility systems are reached through its portal. | Colocation | — | Security: Onsite vs colo | |
| Who runs physical security? Choose one. Security: Physical security | You run every layer. Perimeter, mantrap, CCTV, cage access, the access list and visitors are yours. | Onsite room | — | Security: Who runs it: onsite vs colo |
| Shared with the provider. The provider runs the building, lobby and hall; you own your access list and the controls on your cage or cabinets. | Colocation | — | Security: Who runs it: onsite vs colo |
Step 13
Ops and lifecycle
DCIM, BMS and EPMS, monitoring and how physical work gets done. Physical security is part of the Security step.
| Constrained by | 1. Requirements and capacity envelope, 2. Site model, 4. Power, 5. Cooling, 8. DC fabric |
| Locks in | Ongoing staffing; Audit evidence |
| Onsite room | Full facility operations; you run physical security (detail on Security). |
| Colocation | Remote hands and the provider portal; physical security shared with the provider (detail on Security). |
| Detail | Ops: DCIM / BMS / EPMS · Ops: Sensors & monitoring · Governance: Evidence the infrastructure must produce |
Decisions
| Decision | Option | Path | Locks in | Detail |
|---|---|---|---|---|
| Which monitoring platforms do you run? Choose any that apply. Ops: DCIM / BMS / EPMS | DCIM. Assets, elevations, capacity and cabling. | Both | — | Ops: DCIM |
| BMS. Mechanical plant and HVAC setpoints. | Onsite room | — | Ops: BMS | |
| EPMS. UPS, PDU and branch metering, and PUE. | Onsite room | — | Ops: EPMS | |
| Provider portal. Facility power, cooling and access data from the provider, alongside your own DCIM and monitoring. | Colocation | — | Ops: DCIM / BMS / EPMS | |
| Who does the physical work? Choose one. Network: Out-of-band management | Your own staff. Your team or contractors work in the room; the OOB network still shortens recovery. | Onsite room | — | Network: Out-of-band management |
| Provider remote hands plus your OOB. Keep remote hands for hardware swaps and cabling, and do everything else over OOB and console. | Colocation | — | Network: Out-of-band management |