ISO/IEC 22237 / EN 50600 certification and requirements, for data centres customers can depend on.

What it is

What are ISO/IEC 22237 and EN 50600?

ISO/IEC 22237 is the international series on data centre facilities and infrastructures, developed by ISO/IEC JTC 1/SC 39. EN 50600 is the European series from CENELEC TC 215 on which it was built: the first editions of the EN parts were published by ISO and IEC as Technical Specifications and are now being developed into full International Standards. The two series cover the same ground under different numbering.

Part 1 sets the common concepts, terms and reference models, and a classification of facilities by availability, security and energy efficiency. The remaining parts apply that classification to the building, the power supply, environmental control, cabling, physical security and the information needed to run the facility. An operator uses the series to decide what level of resilience and protection each part of the site needs, to design and check the infrastructure against it, and to describe the result to customers in terms they recognise.

It is a facility standard, not a management system standard. It does not replace ISO/IEC 27001 for information security or ISO 22301 for continuity; it covers the physical infrastructure those systems depend on.

Current editions. ISO/IEC 22237-1:2021, 22237-3:2021 and 22237-4:2021 are published International Standards; Parts 2 and 6 followed in February 2024. Part 5 (cabling) and Part 7 (management and operational information) are still Technical Specifications from 2018, with revisions under way at ISO. A Technical Specification on resilience indicators, ISO/IEC TS 22237-31, was published in February 2026. Your assessor confirms which edition of each part applies to your assessment.

Who it is for

Who needs ISO/IEC 22237 / EN 50600?

The series matters to anyone whose business depends on a facility staying up: colocation and wholesale providers, cloud and hosting firms, banks and telecom operators with their own halls, and enterprises consolidating server rooms. Operators usually come to Sterling from one of four starting points:

• Customers want proof of resilience. Enterprise tenants and their auditors ask what availability and protection level the site was designed to, and want an independent answer rather than a marketing sheet.
• A tender names the series. Some public and private requests for proposals cite EN 50600 or ISO/IEC 22237 levels. Confirm the parts, levels and form of evidence they expect before committing.
• Regulators and resilience rules. Operational resilience and outsourcing obligations push regulated firms to show that critical hosting is physically sound. The series gives a shared vocabulary for that evidence, alongside your legal advisers' reading of the rules.
• A group standard across several sites. Groups with facilities in different countries want one yardstick for new builds, acquisitions and upgrades, so every site is described and compared the same way.

Conformity describes how the facility was designed and is run. Uptime still depends on maintenance, people and change control day after day.

Requirements

What are the main ISO/IEC 22237 / EN 50600 requirements?

The requirements sit in separate parts, each with its European counterpart. You choose the availability and protection levels your business needs under Part 1, then the other parts set what the infrastructure must provide at those levels. The list below maps the parts by title; the detailed requirements and recommendations are in each part.

• Part 1 General concepts (EN 50600-1): terminology, reference models, business risk and cost considerations, and the classification by availability, security and energy efficiency.
• Part 2 Building construction (EN 50600-2-1): site selection, protection from environmental risks, construction, intrusion, fire and water protection.
• Part 3 Power distribution (EN 50600-2-2): the supply and distribution of power to the facility and the IT load.
• Part 4 Environmental control (EN 50600-2-3): cooling and the environmental conditions of the computer rooms.
• Part 5 Telecommunications cabling infrastructure (EN 50600-2-4): network, monitoring and building automation cabling, with pathways and enclosures.
• Part 6 Security systems (EN 50600-2-5): physical security against unauthorised access, intrusion, fire and environmental events.
• Part 7 Management and operational information (EN 50600-3-1): the information and processes needed to operate and manage the facility.
• Key performance indicators (EN 50600-4 and ISO/IEC 30134 series): measures such as power usage effectiveness and renewable energy factor, with ISO/IEC TS 22237-31 for resilience.

Conformity route

How is conformity with ISO/IEC 22237 / EN 50600 assessed?

The standards bodies do not operate a certification system for this series. An operator can declare conformity itself, a customer can check it, or an independent third party can assess it; several third-party certification schemes are offered in the market. Whichever route you take, the work is the same: a facility that meets the parts you claim, and evidence that proves it.

1. 01
   Set the claim.Agree which sites, halls and parts are in scope, and the availability and protection levels you intend to claim.
2. 02
   Gap analysis against each part.Compare design, installed infrastructure and operating practice with the requirements, and agree actions, owners and dates.
3. 03
   Close the gaps and build the evidence.Your engineers and contractors carry out physical changes; we put operating information, records and indicators in order.
4. 04
   Internal review.An internal assessment and management review test the claim before anyone outside does, with findings closed with evidence.
5. 05
   Declare or be assessed.Issue a supported self-declaration, or host the independent assessor's review and respond to its findings.

Check the route before you sign. Ask any assessment provider which scheme it operates, who owns that scheme, which edition and parts it assesses against and whether it holds accreditation for that work, then confirm the accreditation directly with the accreditation body. A report that does not state its scope, parts and levels will not answer your customer's question.

Cost

How much does ISO/IEC 22237 / EN 50600 work cost?

Cost is driven far more by the facility than by the paperwork. A single modern hall with complete design records is a very different project from an older multi-site estate where drawings no longer match what is installed.

Timeline

How long does it take to become assessment-ready?

For an operating facility whose infrastructure already matches its intended levels, the work is mostly evidence and operating information, often four to nine months as a planning estimate. Where physical upgrades are needed, the engineering programme sets the pace, not the documentation.

Share any tender or customer date at the outset. We will say plainly whether it is realistic and which decisions must be taken early.

Your engagement

What your ISO/IEC 22237 / EN 50600 engagement includes

Engagements follow Sterling OS™. Choose Design™, where we guide and your team does the work, or Drive™, where we manage the programme for you; they are alternative support levels, not stages. Sustain™ keeps the evidence current once the assessment is done, and Automate™ is Effivity running underneath. Sterling does not certify, assess or issue any conformity statement for the series; we prepare you, and the independent assessor or your own declaration makes the claim.

• Scope, levels and gap analysis

  Parts, sites and target levels agreed, with a costed action plan and owners.

• Operating information and records

  Procedures, registers and records for operation and management, built with your facilities team.

• Effivity ISO & GRC software

  Evidence, maintenance actions and findings in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Conducted or facilitated as agreed, with findings closed before the assessor arrives.

• Assessment readiness

  Evidence packs, walk-throughs and support until the assessor's findings are answered.

Physical design and engineering works remain with your engineers and contractors; conformity decisions remain with the assessor or your own declaration.

Often combined with

Standards organisations pair with ISO/IEC 22237 / EN 50600

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
• Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
• DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.