IMDA introduces guidelines for cloud providers, data centres

IMDA today introduced Advisory Guidelines for cloud providers and data centres operators. Here’s what it is, and what caught my attention.

Protecting digital services

Digital services are now the lifeblood of modern cities. Inconvenience aside, serious disruptions in cloud services or data centres could potentially bring a city to its knees.

With this in mind, the MDDI, IMDA, CSA, and GovTech have come together to develop Advisory Guidelines (AG) for cloud services and data centres.

The idea is to minimise disruptions to cloud services and data centres.

Recent outages

These aren't hypothetical scenarios. Among others, the IMDA press release mentioned fires and cooling system failures as potential risks.

Just last year:

• A fire started in a battery room in Digital Realty's SIN11 data centre that badly impacted Alibaba Cloud. Read "Why fire trucks are still there 24h later" here.
• A technical issue with the chilled water system at Equinix's SG3 data centre caused widespread disruption to DBS. Read "DBS experience widespread disruption" here (LinkedIn).

What caught my attention

What do the new AGs recommend? The list is lengthy, but here's two that caught my attention.

Both cloud providers and data centre operators are recommended to:

• Conduct penetration testing from the Internet.
• Ensure open-source components are safe to use.
• Do background checks of employees, [contractors].

These measures are significantly more involved even for cloud service providers, with specific measures to address the growing threat of supply chain attacks.

For data centre operators, these will require substantial changes in how they operate. I'm not sure if most have what it takes, however.

For data centre operators

Two other interesting clauses got me thinking.

• To shorten the duration of service disruptions, data centre operators are asked to implement strategies and solutions for areas that include fire detection and suppression.
• Obtain support from top management to ensure that resources for business continuity (BC) are available. The BC plan should also be updated, such as when lithium-ion batteries are deployed.

But are data centre operators ready?

Shape of things to come

Though optional now, parts of the AG will also inform the upcoming Digital Infrastructure Act set to be introduced later this year.

According to IMDA, the Act will be for the bigger data centre operators and cloud service providers.