How to audit your data center provider in Mexico: the 40-point checklist your internal audit doesn’t have

What separates a serious audit from a site tour

Auditing a data center provider in Mexico is not the same as visiting the site, walking through the data hall, and signing an attendance record. A real operational audit requires a structured checklist that covers the five critical dimensions of operations: physical infrastructure, electrical infrastructure, mechanical (cooling) infrastructure, connectivity and networks, and security governance. The following 40-point checklist is the one mature companies use to evaluate their provider before signing a contract, during operation (annually), and when incidents require verification.

Block 1 — Electrical infrastructure (10 points)

1. Contracted capacity vs utilized capacity. How many kVA are contracted with CFE? What is the average monthly load? If the load exceeds 80% of contracted capacity, the data center carries operational and electrical risk.

2. Type of service entrance. Is it low voltage (220/127V or 480/277V) or medium voltage (13.8 kV, 23 kV, 34.5 kV)? Sites above 1 MW should have a medium-voltage service entrance. If the service entrance is low voltage, future growth is limited by the capacity of the local grid.

3. Feeder redundancy. Is there a single CFE feeder or two redundant feeders from different substations? Tier III/IV data centers require a dual feeder.

4. Redundant UPS. Are the UPS units in N+1, 2N, or N configuration? What is the runtime of the battery bank at full load? Minimum 10 minutes for Tier III sites.

5. UPS battery type. Are they VRLA (valve-regulated lead-acid), Li-ion (lithium-ion), or NiCd? Li-ion batteries have longer service life and higher energy density, but they require an active BMS (Battery Management System).

6. Backup diesel generator. How many generators? Capacity of each? N+1 or 2N configuration? Fuel runtime at full load? Minimum 24 hours of runtime for Tier III sites.

7. ATS (Automatic Transfer Switch). Is it open-transition, closed-transition, or soft-load? What is the WCR (withstand and closing rating)? Is it coordinated with the short-circuit study?

8. STS (Static Transfer Switch) on critical loads. Do critical single-corded loads have STS protection? What is the guaranteed transfer time?

9. Real PUE vs promised PUE. What is the monthly operational PUE for the last 12 months? Does the provider deliver PUE measurement with a documented methodology, or only an estimate?

10. Transfer and bypass board. Is there a maintenance bypass on the UPS, the generator, the STS? Is the bypass procedure documented?

Block 2 — Mechanical and cooling infrastructure (8 points)

11. Cooling type. CRAC, CRAH, in-row, or hybrid? What is the total cooling capacity in kW?

12. Cooling redundancy. N+1, 2N, or N? How many redundant units are available in case of failure?

13. Aisle containment. Is there cold aisle containment or hot aisle containment? What is the expected containment efficiency?

14. Operating temperature range. What is the rack intake air temperature range maintained by the data center? Does it meet ASHRAE TC 9.9 classes A1-A4?

15. Relative humidity. What is the relative humidity range maintained by the data center? Is there active humidity control?

16. Free cooling. How many hours per year does the data center operate in free cooling mode? What is the temperature threshold for activating free cooling?

17. WUE (Water Usage Effectiveness). What is the annual operational WUE? If the provider does not measure WUE, it is ignoring a critical operational indicator.

18. Maintenance of mechanical equipment. How often are chillers, CRAH/CRAC units, and cooling towers serviced? Are there auditable records?

Block 3 — Connectivity and networks (6 points)

19. Available carriers. How many carriers have physical presence at the site (not resold)? Minimum 3 Tier 1 carriers for redundancy.

20. Fiber entrance redundancy. Are there two or more physically separated fiber entrances? Minimum 2 redundant entrances for Tier III sites.

21. Meet-me room (MMR). Is there a meet-me room? How many active cross-connects does it support?

22. Direct peering. Is there direct peering with Tier 1 transit providers? What is the latency to the main exchange points?

23. Bandwidth capacity. What is the total available bandwidth capacity? Is there documentation of connectivity SLAs?

24. Structured cabling adherence. Does the internal cabling meet TIA-568 or ISO/IEC 11801? Is there Fluke certification of the links?

Block 4 — Physical and logical security (10 points)

25. Physical access control. Two-factor (card + biometrics)? How many control points before reaching the rack? Auditable access log?

26. Perimeter and room CCTV. Cameras on the perimeter, main entrance, data hall, electrical room? Minimum 90 days of video retention?

27. Fire detection and suppression. Early detection system (VESDA or equivalent)? Suppression with clean agent (FM-200, Novec 1230) or water mist? Conventional sprinklers NOT in the production data hall?

28. 24/7 security personnel. Is there on-site security personnel 24 hours a day? How many shifts? What is the incident response procedure?

29. Valid ISO 27001. Does the data center hold a current ISO 27001 certification? When was the last external audit? Does the certification scope cover the services the customer contracts?

30. SOC 2 Type II. Does the provider have a SOC 2 Type II report for the last 12 months? What do the audited controls cover?

31. Annual pentest. Does the data center undergo annual penetration testing by independent third parties? Can the executive report be obtained?

32. Logical environment segregation. Are production, pre-production, development, and testing environments logically segregated? Are there documented firewall rules between segments?

33. Data encryption. Is data at rest encrypted (AES-256 or equivalent)? Data in transit (TLS 1.2 minimum, ideally TLS 1.3)? Where are the cryptographic keys managed (HSM or equivalent service)?

34. Incident response plan. Is there a documented security incident response plan? Is there a 24/7 SOC/NOC with response capability? What is the customer notification SLA?

Block 5 — Governance, SLA, and regulatory adherence (6 points)

35. Contractual SLAs. Are the SLAs documented in the contract? Do they cover availability (monthly uptime), performance (latency, packet loss), incident response (response and resolution time), and credits for non-adherence?

36. Monthly reports. Does the provider deliver monthly operational reports with real metrics? Are the reports auditable or summaries?

37. Third-party certifications. Does the data center maintain Tier certifications (Uptime Institute), TIA-942, ISO 22301 (business continuity), ISO 27001, SOC 2? Are the certifications current and does the scope cover contracted services?

38. Data center DR plan. Does the data center have a DR site? Where? What are the demonstrated RTO and RPO? Is there evidence of DR testing in the last 12 months?

39. Audits permitted in the contract. Does the contract allow the customer and its external auditors to enter the site with reasonable prior notice (typically 72 hours)? Is there a cap on the number of annual audits?

40. Adherence to Mexican regulation. Does the data center adhere to NOM-001-SEDE-2012, LGPD (LFPDPPP), and the applicable CNBV provisions if the customer is a financial institution? Is there documentary evidence?

How to use this checklist

Before signing a contract (pre-contract audit): apply all 40 points. Any unsatisfactory answer on points 1-7, 19-20, 25-27, or 35-37 should block contracting until it is resolved. The remaining points are important but admit a remediation plan.

Annually during operation: apply all 40 points as part of the annual provider audit. Document findings, agree on remediation with timelines, and follow up in quarterly audits.

After a relevant incident: apply the points related to the incident to identify root cause and verify that the provider corrected the condition.

What internal audits typically lack

Internal audit at most companies focuses on financial controls, regulatory adherence, and general IT risk management. What is typically missing:

• Specific knowledge of electrical infrastructure (transformers, UPS, generators, ATS).
• Specific knowledge of mechanical infrastructure (chillers, CRAH, free cooling).
• Specific knowledge of structured cabling and optical fiber.
• Personnel with Tier or TIA-942 certification.
• A 40-point audit template specific to data centers.

That is why mature companies hire specialized external auditors to complement the internal audit at the data center. A specialized external audit typically costs USD $2,857 to USD $11,428 (approx. $50,000 to $200,000 MXN at 17.5 MXN/USD, verify Banxico FIX on publication day), depending on site size, and it pays for itself quickly when it detects conditions that could cause major operational incidents.

Sources

1. Diario Oficial de la Federación (2014, current reforms). Ley Federal de Protección de Datos Personales en Posesión de los Particulares. https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf
2. Diario Oficial de la Federación. NOM-001-SEDE-2012 — Instalaciones Eléctricas (utilización). https://www.dof.gob.mx/normasOficiales/5567/se11/se11.html
3. Noxtel.mx (2026). Data Centers in Mexico: The Honest 2026 Guide. https://noxtel.mx/en/data-centers-in-mexico-the-honest-2026-guide
4. Noxtel.mx (2026). How to choose a data center provider in Mexico: SLA, contract, and key clauses. https://noxtel.mx/en/how-to-choose-a-data-center-provider-in-mexico-sla-contract-and-key-clauses
5. ASHRAE Technical Committee 9.9 (2024). Thermal Guidelines for Data Processing Environments, 5th Edition. https://www.ashrae.org/technical-resources/bookstore/thermal-guidelines-for-data-processing-environments