Inside a Data Centre: Power, Cooling, Network, and Security Explained

Introduction

Almost everything your business runs on, from email and ERP to AI tools and customer portals, ends up in a data centre. Yet most decision-makers have never seen the inside of one, and the vocabulary (Tier III, N+1, PUE, meet-me room) is used in vendor proposals as if everyone already knows what it means.

This guide walks through a data centre layer by layer, from the utility feed at the property line to the cable plugged into a server. It explains what each layer does, how redundancy works, which numbers are worth trusting, and what to ask when you evaluate a facility. If you are weighing colocation against cloud, multi-cloud strategy and data sovereignty are the natural companion reads.

The Five Layers of a Data Centre

ISO/IEC 22237 (the international counterpart of the European EN 50600 series) is useful here because it gives these layers formal names. It also defines availability classes 1 to 4, from no redundancy and a single supply path up to system-level redundancy across multiple paths, and protection classes covering unauthorised access, intrusion, fire, and environmental hazards. When a facility says it is "designed to" a standard, ask which classes, for which layers.

Layer 1: The Power Chain

Power is where data centres are won and lost. The job is simple to state and hard to do: deliver clean, continuous electricity to every rack, through utility failures, equipment faults, and maintenance work.

Redundancy decoded: N, N+1, 2N, 2N+1

Redundancy is a spectrum of insurance policies. A bank's core systems may justify 2N. A development environment may be fine on N+1 or less. Redundancy on paper only helps if it works in practice, so ask whether failover has been tested under load, and when.

The honest weak spot: power causes the most outages

Uptime Institute's 2025 survey found that 50% of operators had experienced at least one impactful outage in the past three years, down from 53% the year before. Of the most recent impactful outages, 45% were caused by power, down from 54% in 2024, with network at 14% and IT systems at 9%. Power is improving but remains the largest single cause by a wide margin. The outage-cause chart appears in the efficiency section below.

Layer 2: Cooling

Every watt of electricity a server uses ends up as heat, and that heat has to leave the building. Cooling design is the layer that changed most in the last decade, and AI is changing it again.

What temperature are we actually aiming for?

A common assumption is that data halls should be as cold as possible. They should not. ASHRAE's thermal guidelines (5th edition, 2021) set a recommended server inlet range of 18 to 27 degrees Celsius for the main equipment classes, with wider allowable ranges, for example 15 to 32 degrees Celsius for class A1. The key specification is the temperature of the air entering the equipment, not the room average. NREL's modelling shows why this matters: in its example, operating within the recommended range cut modelled cooling energy by about 95% compared with a conventional setup, and operating within the allowable range by about 98%. Treat those as illustrative modelled savings, not a promise for any real site.

Three ways to remove the heat

NREL summarises why liquid is gaining ground: liquid conduits need 250 to 1,000 times less space than air conduits to move the same heat, and moving heat with liquid takes 10 to 20 times less energy. NREL also expects rising processor power to push facilities toward warm-water cooling, with pumps replacing fans and potentially less reliance on cooling towers.

How dense are racks today?

Uptime Institute's 2025 survey puts average rack density at almost 9 kW, up from 8.3 kW a year earlier, or 7.5 kW if high-density outliers are excluded. More than 80% of operators have no racks above 30 kW. In its 2023 survey the average was below 6 kW. So the headline about extreme AI density is real but still concentrated at a minority of sites. That matters for you: a standard enterprise workload does not need a liquid-cooled facility, and paying for one is waste.

Layer 3: The Network

A data centre without good connectivity is an expensive warehouse. The network layer has two parts: how the outside world gets in, and how traffic moves inside.

• Carrier entry: fibre from telecom carriers enters the building, ideally by physically separate routes.
• Meet-me room (MMR): the neutral space where tenant and carrier cabling terminates and cross-connects are patched. In a carrier-neutral facility it is operator-managed and open to any qualified provider. Some sites run two MMRs in separate fire compartments, which allows truly diverse circuit pairs.
• Cross-connect: a dedicated physical cable linking two parties in the same facility, for example your rack to a carrier, a cloud on-ramp, or another tenant. It is a layer 1 circuit. It is usually billed as a one-time installation charge plus a recurring monthly fee per circuit.
• Inside the hall: modern data halls typically use a leaf-and-spine switch design so every server is a predictable number of hops from every other. That is a common design pattern rather than a requirement.

One practical warning. Two carriers do not equal redundancy if their cables share a duct, an entry point, or a meet-me room. Ask where diversity is separated at every shared layer: panels, risers, MMRs, carrier equipment, entry points, and metro routes.

Layer 4: Physical Security

Physical security in a data centre is built as concentric rings, each one adding a check before someone reaches your equipment.

ISO/IEC 22237 Part 6 covers security systems and defines protection classes for unauthorised access, intrusion, fire, and environmental hazards. Independent attestations such as ISO/IEC 27001 and SOC 2 are common asks from enterprise buyers. A certificate is a starting point, not proof. Check its scope, which should include the specific site you are renting from.

The Tier System: What It Says and What It Doesn't

The Uptime Institute Tier classification is the most quoted label in the industry and the most misread.

Three points to keep in mind:

1. Tiers describe topology. They reflect how the infrastructure is designed. Operational discipline still matters, and poor practice can erode the benefit of a high tier.
2. Certification has stages. Uptime Institute offers certification of design documents, of the constructed facility, and of operational sustainability. A facility may hold only a design certificate. Ask which one, and ask for the certificate.
3. Be careful with availability percentages. You will often see figures such as 99.671% for Tier I up to 99.995% for Tier IV quoted alongside the tiers. These are widely repeated industry shorthand, often without a cited source, and they are not a service commitment. Your guarantee is whatever your contract's SLA says, including how it defines downtime and what remedy you receive.

Some operators also say "Tier III-equivalent" or "Tier III-ready." That language means the design follows similar principles but has not been certified by the Uptime Institute. It can be perfectly good, but it is a different claim.

The Numbers Behind the Building: Energy and Efficiency

The IEA describes AI as the most important driver of this growth, and notes that a typical AI-focused data centre uses as much electricity as about 100,000 households, with the largest ones under construction using many times more. Data centres account for roughly a tenth of global electricity demand growth to 2030. For the wider picture on cost and scale of AI infrastructure, see our post on the economics of training large AI models, and for the national angle, sovereign AI.

PUE: the efficiency number everyone quotes

Power usage effectiveness is the ratio of total facility energy to the energy that reaches IT equipment. A PUE of 2.0 means one extra watt of overhead (mostly cooling and power distribution losses) for every watt of IT load. A value near 1.0 means almost nothing is wasted on overhead.

Why has the average stalled? The big early wins (containment, better chillers, warmer set points) are done. Further gains take serious capital, and many older sites are constrained by their design. At the other end, Google reports a fleet-wide average PUE of 1.09 for 2025, measured continuously across its worldwide fleet on a trailing twelve-month basis. Treat the two figures as context, not a league table. Hyperscale operators with uniform purpose-built fleets, newer designs, and tight control are not comparable to a mixed industry sample, and measurement boundaries can differ. When a colocation provider quotes a PUE, ask whether it is design or measured, annual or best-month, and for which halls.

The People Layer Nobody Photographs

One last layer rarely makes the brochure: the staff. Uptime Institute's 2025 survey found 46% of operators struggle to find qualified candidates and 37% struggle to retain staff, with operations management the largest skills gap (cited by 39%). Its 2023 survey reported similar patterns, with the largest gaps in operations, mechanical, and electrical roles. When you evaluate a facility, ask who is on site overnight, how technicians are trained on the failover procedures, and how often those procedures are rehearsed. A well-designed building run by an understaffed operator is a risk of a different kind. For how to rehearse the plan on your side, see our post on business continuity planning beyond IT.

Colocation, Cloud, or Your Own Room: What This Means for Your Decision

Understanding the layers changes the questions you ask.

• If you run your own server room, you are responsible for all five layers at much smaller scale and usually without 2N power, proper containment, or a dedicated security ring. That can be a fine choice for small workloads. It is rarely a fine choice for anything your revenue depends on.
• If you use colocation, you rent the building, power, cooling, and security, and you bring your own equipment. The questions below matter most.
• If you use public cloud, the provider handles these layers for you, but they still exist. Your resilience depends on which regions and availability zones you use, and on where your data physically lives, which connects directly to data sovereignty.
• If you care about energy and carbon, the facility's measured PUE, power source, and cooling approach feed into your Scope 2 and Scope 3 reporting. See Green IT for the practical side.

Ten Questions to Ask on a Facility Tour

What to Do Next

Start with the workloads, not the building. Classify what truly needs 2N-grade resilience, what can tolerate N+1, and what could run in cloud. Map your regulatory obligations on data location. Then compare facilities against the checklist above, using the contract's SLA rather than the tier label as the benchmark.

If you are weighing a data centre move, a colocation tender, or a hybrid design and want an independent view on requirements and vendor claims, Idrak's consulting practice supports infrastructure assessments and vendor evaluations from requirements through contract review.

Frequently Asked Questions