ISO 22237 for Data Centers in Mexico: How to Implement It Without Blowing Your Budget

ISO/IEC 22237 is the international standard series that replaced the European EN 50600 as the reference framework for data center design, construction, and operation. Published between 2018 and 2024, it covers everything from site conception to equipment retirement, with focus on availability, physical security, energy efficiency, and sustainability. If your data center serves customers who demand certifications, or if you plan to participate in tenders with multinational corporates, this is the standard they will ask for. The question is how to achieve compliance without the project cost eating the CapEx.

What the 22237 series covers (and what it does not)

The series is made up of 8 main documents: 22237-1 (general concepts), 22237-2 (design), 22237-3 (management), 22237-4 (environmental sustainability), 22237-5 (telecommunications infrastructure), 22237-6 (power systems), 22237-7 (cooling), and 22237-8 (security). What it does NOT cover is day-to-day operation: for that you need ISO/IEC 20000-1 (IT service management) or ISO 27001 (information security). 22237 tells you how to design and build; it does not certify how you operate.

The most expensive mistake: trying to implement everything at once

The most common mistake by a Mexican SMB that decides to 'implement ISO 22237' is trying to cover all 8 parts simultaneously. The typical result is an 18-month project with a tripled budget, no partial deliverables, and no clarity on which part delivers immediate value. A reasonable implementation follows a different order.

Recommended implementation order by budget

Four phases that a typical 5-50 rack data center can complete in 9-12 months without blowing the budget:

Phase 1 — Design and availability (Parts 1, 2, and 6)

Document the physical and logical topology of the data center, calculate target availability per the standard's classes (Class 1 to Class 4), and verify that the electrical system meets N, N+1, or 2N redundancy based on the target class. This phase does not require new civil works if your DC is already built; it is primarily a documentary audit and design. Typical cost: 1-3 months of fees for a specialized consultant.

Phase 2 — Telecommunications (Part 5)

This is the phase that delivers the most value to a corporate client: it certifies that your structured cabling meets the standard's specifications (category, pathway separation, pathway redundancy). For a 10-50 rack DC, this phase typically takes 2-3 months and can be combined with any cabling refresh you already have planned.

Phase 3 — Energy efficiency and sustainability (Parts 3 and 4)

PUE, WUE, CUE metrics, plus the sustainability criteria the standard introduces (renewable energy use, e-waste management, life-cycle assessment). For most data centers in Mexico, this phase is mainly measurement and reporting; the big investments (high-efficiency UPS, free-cooling, on-site renewable energy) only pay off if you have enough load to amortize them.

Phase 4 — Physical security (Part 8)

This is the cheapest phase to implement if you already have a reasonable access control and CCTV system. The standard requires two-factor authentication access control, video surveillance with at least 90 days of retention, visitor logs with photo, and mantrap cabinets where applicable. The investment is usually $10-30k USD in additional equipment, not civil works.

What the standard requires that almost nobody has

There are three 22237 requirements that appear in most audits as recurring findings:

• 'As-built' design documentation. The standard requires that the DC drawing reflect what was actually built, not what was on the original drawing. The reality of most DCs in Mexico is that the drawings live in the head of the engineer who designed them and nobody else has seen them.
• Equipment retirement plan. Part 1 requires a documented procedure to retire IT equipment at end of life without affecting the operation of the rest. The reality is that equipment piles up in a corner until someone sends it for recycling.
• Quarterly energy efficiency metrics reported to the steering committee. The standard requires that the efficiency metrics (PUE, WUE, CUE) reach the budget decision-makers, not only the operations team.

Realistic cost by data center size

What it costs to implement the 4 phases above in Mexican pesos, based on ranges observed in 2024-2025 projects:

• Small DC (5-15 racks): 800k-1.5M MXN. Time: 4-6 months. Includes consulting plus documentation plus measurement. No civil works.
• Medium DC (20-80 racks): 1.5M-4M MXN. Time: 6-9 months. Includes Phase 2 with cabling refresh plus PUE/WUE instrumentation.
• Large DC (100+ racks): 4M-15M MXN. Time: 9-15 months. May include civil works in Phase 4 (mantraps) and energy efficiency projects.

Certification: when it is worth it, when it is not

ISO 22237 does not have a universal certification scheme like ISO 27001 or PCI DSS. What exists are second-party or third-party compliance audits (you hire the auditor, or a customer does). For most operations, the 'certification' is actually a Compliance Report signed by an accredited auditor. If your customer asks for certification, ask specifically what level of audit they accept.

Practical recommendation

Before signing a consulting contract to 'implement ISO 22237', request a 2-week initial assessment that tells you exactly which parts pass, which parts fail, and the remediation sequence with estimated cost per phase. Any serious consultant offers it as the first deliverable. If someone tries to sell you an 18-month project without that prior assessment, they have not seen your data center.

Sources

1. ISO/IEC 22237 — Information technology — Data centres (full series) — https://www.iso.org/standard/77771.html
2. IEC Blog — Data centres and the new ISO/IEC 22237 series — https://www.iec.ch/blog/data-centres-new-isoiec-22237-series-make-them-more-sustainable
3. Uptime Institute — Tier Classification and Certification (complementary reference) — https://uptimeinstitute.com/tier-certification
4. TIA — TIA-942 Telecommunications Infrastructure Standard for Data Centers — https://www.tiaonline.org/