How to Build a Data Center From Scratch: What Is Required

To build a data center from scratch you need six things in order: a defined IT load and resilience target, a site with enough utility power and fibre, an electrical chain (utility feeds, transformers, switchgear, UPS, generators and power distribution), a cooling system matched to rack density, carrier connectivity with a meet-me room, and fire protection plus layered physical security. Around those sit permits, a trained operations team, a budget that public cost surveys now put in the range of roughly 11 to 18 million US dollars per megawatt of IT capacity, and an operating model you can audit.

This guide walks through each requirement in the order a real project meets them, using public sources such as Uptime Institute, TIA, ASHRAE (via the US Department of Energy), The Green Grid, DOE and NIST. Electrical, fire and life safety work is described at a planning level only. Design, installation and testing of those systems belongs with licensed engineers, licensed electricians and fire protection professionals working to your local code.

Key takeaways

• Start from the load, not the building. The first decision is how many kilowatts of IT equipment you need to run, at what rack density, and how much downtime the business can accept. Everything else is sized from that.
• Tiers describe topology, not quality. Uptime Institute defines four progressive Tiers. Tier III is concurrently maintainable and Tier IV adds fault tolerance; Uptime itself says a Tier IV site is not "better" than Tier II, only suited to different operations.
• Redundancy multiplies cost. N is just enough capacity, N+1 adds one spare unit, and 2N duplicates the whole path. Each step up buys maintainability or fault tolerance and adds equipment, space and capital.
• Cooling is set by rack density. ASHRAE's 2021 recommended inlet range is 18 to 27 degrees Celsius. Air with hot aisle or cold aisle containment handles conventional racks; dense AI racks push designs toward direct liquid cooling.
• Efficiency is measured, not claimed. PUE is total facility energy divided by IT energy. DOE's design guide calls 1.6 standard, 1.4 good and 1.1 better, and Uptime Institute reported a 2022 survey average of 1.55.
• Power and lead times drive the schedule. DOE reports US data centers used about 4.4 percent of national electricity in 2023 and may reach 6.7 to 12 percent by 2028. Utility capacity and long lead equipment, not concrete, usually set the date you go live.
• Budgets are rising. Turner and Townsend's 2025 to 2026 index shows major markets between about 11.6 and 15.2 US dollars per watt, and Cushman and Wakefield's 2026 guide puts average modern greenfield cost at 17.6 million US dollars per MW.
• Operations are half the job. Staffing, maintenance, change control, audits and drive disposal under NIST SP 800-88 run for the life of the building.
• The software inside counts too. BMS, DCIM, BMC firmware, management tools and container images are a supply chain of their own. Inventory and patch them like any other production stack.

Should you build, colocate or go modular?

"From scratch" means different things. Before buying land, compare the three ways organizations usually get data center capacity.

A useful rule: if your load is under a few hundred kilowatts, or you cannot staff a 24 hour operations team, colocation is almost always the practical choice. Our colocation data center security checklist covers what to verify in that case. The rest of this guide assumes you have decided to build.

What is required, at a glance

Step 1: define the load and the tier

How much IT load do you need?

Write down the IT load in kilowatts on day one and at full build, the expected rack density (kW per rack), and how fast you expect to grow. A hall of conventional enterprise racks and a hall of dense GPU racks with the same total load need very different cooling and power distribution. Size the plant for the end state but build in phases, because idle plant wastes capital and also runs inefficiently. DOE's design guide makes this point about UPS systems: a single large UPS paired with an identical redundant unit runs at no more than 50 percent load at full build, and lower before that, which costs efficiency.

What do Uptime Institute's Tiers mean?

Uptime Institute's public tier page describes four progressive Tiers, each including the requirements of the ones below it. In plain terms:

Two points from Uptime's own page are worth repeating. First, the Tiers do not cover building codes, regional weather, security or property use, so a Tier rating is never a complete design brief. Second, Uptime states that a Tier IV data center is not better than a Tier II; the levels fit different business operations. Uptime certifies designs and constructed facilities through its own programmes; claiming a Tier without that certification is a common and avoidable credibility problem.

Where does TIA-942 fit?

ANSI/TIA-942 is the Telecommunications Industry Association's Telecommunications Infrastructure Standard for Data Centers. TIA describes it as specifying minimum requirements across site location, architectural, electrical, mechanical, fire safety, telecommunications and security. The current revision is TIA-942-C, maintained by TIA Engineering Committee TR-42, and TIA says the revision added requirements reflecting AI driven density and sustainability. TIA-942 has its own rating and certification scheme, separate from Uptime's Tiers. This post only summarises TIA's published scope.

N, N+1 and 2N explained

Redundancy notation describes how much spare capacity exists beyond the need, which engineers call N.

Redundancy applies to components (how many UPS modules) and to paths (how many independent feeds reach a rack). A design can be N+1 on generators and 2N on UPS paths. Tier III and Tier IV are mostly about paths, not just component counts.

Step 2: choose the site

Site selection is where most projects succeed or fail, because the hardest constraint, utility power, is fixed by location. Score candidate sites against these factors:

• Utility capacity and timeline. How many megawatts can the utility deliver, from how many substations, and when. Ask about dual feeds from separate substations if your tier target needs them. Our post on what a data center needs to connect to the grid covers the interconnection steps.
• Fibre. Distance to multiple carriers, existing long haul routes and the option to bring two physically diverse duct banks into the building.
• Natural hazards. Flood zones, seismic risk, wildfire, hurricanes and extreme heat. Climate also changes cooling cost; see how location changes cooling and power.
• Water. Evaporative cooling and some chilled water designs consume water. Check supply, discharge permits and local politics. Our data center water use explainer covers WUE.
• Zoning and neighbours. Generator noise and emissions, building height, setbacks and community acceptance.
• Labour and logistics. Access for heavy deliveries such as transformers and generators, and a local pool of electricians, mechanical technicians and operators.

For a structured scoring approach, our step by step site selection guide walks through how large operators compare sites.

Step 3: design the power chain

Safety note. Medium and low voltage electrical systems can kill. Everything below is for planning conversations only. Design must come from a licensed electrical engineer, and installation, testing and maintenance must be done by licensed electricians and qualified persons under your local electrical code (in the US, NFPA 70, the National Electrical Code, as adopted by your jurisdiction) and OSHA electrical safety requirements, including arc flash protection.

A data center power chain has five links. Each can be built to N, N+1 or 2N.

Utility feeds and the substation

Large sites take power at medium or high voltage, often through an on site substation. Tier III and IV designs often seek two feeds from different utility substations, but many designs still treat on site generators as the source they can rely on, because the grid is outside the owner's control. DOE's December 2024 announcement of the LBNL report said data centers used about 4.4 percent of total US electricity in 2023, up from 58 TWh in 2014 to 176 TWh in 2023, and could use 6.7 to 12 percent (325 to 580 TWh) by 2028. That growth is why utilities increasingly ask large loads for deposits, studies and long lead commitments.

Transformers and switchgear

Transformers step voltage down; switchgear protects and routes it. Automatic transfer switches move load from utility to generator. These items have some of the longest lead times on the project, and our transformers and switchgear lead times explainer covers why. Order them as soon as the design is frozen.

UPS: bridging the gap

The uninterruptible power supply carries the IT load through utility disturbances and for the seconds it takes generators to start and accept load. DOE's design guide notes UPS systems can be battery, rotary (flywheel), fuel cell or other types, and that double conversion UPS efficiency improved from 85 to 90 percent in the 1990s to 95 percent or higher in 2023. Its practical advice is to keep UPS load factor high by using several smaller modules rather than one large unit plus one identical spare. Battery chemistry (lead acid or lithium ion) also affects fire protection, so involve the fire protection engineer.

Generators and fuel

Standby diesel or gas engine generators carry the site through long outages. Plan for fuel storage and delivery contracts, load bank testing, and emissions. In the US, stationary engines are regulated by EPA rules, including the NESHAP for reciprocating internal combustion engines and the NSPS for compression ignition and spark ignition engines, typically administered through state air permits that limit non emergency run hours. Ask your state air agency early, because generator permits can gate the whole schedule. Our backup power explainer compares generators, UPS and batteries in more detail.

Distribution to the rack

Power distribution units (PDUs) and remote power panels feed busway or whips to each rack, where rack PDUs feed servers. Dual corded servers on A and B feeds are what make 2N distribution useful; a single corded device needs a rack level transfer switch to benefit.

Step 4: design the cooling

Every watt delivered to IT becomes heat that must be removed. Cooling design starts from the thermal envelope the IT equipment needs.

What temperature should a data center run at?

ASHRAE Technical Committee 9.9 publishes thermal guidelines for data processing environments. DOE's 2024 best practices guide reproduces the 2021 air cooling envelope:

DOE's note on the humidity ceiling: if testing shows corrosion levels above ASHRAE's limits, the maximum drops to 50 percent. The recommended envelope is where to run normally; the allowable envelopes are what equipment classes are tested to tolerate. Running warmer saves cooling energy, but DOE warns that server fans speed up as inlet temperature rises, so measure total energy rather than assuming warmer is always cheaper.

Air cooling and containment

Racks are arranged in rows with fronts facing a cold aisle and backs facing a hot aisle. DOE's guide explains that strict hot aisle and cold aisle separation, sealed with containment, stops hot and cold air from mixing, lets the hot aisle act as a heat exhaust, and raises return air temperature. Higher return temperature extends economizer hours, which are the hours when outside air or cooling towers can do the work without running compressors.

Chillers, DX and economizers

Larger sites use chilled water plants with chillers, cooling towers or dry coolers, pumps and computer room air handlers. Smaller sites often use direct expansion (DX) units. DOE notes that a DX unit with an air side economizer can be a very energy efficient choice for a small data center, depending on climate. Air side economizers bring in filtered outside air; water side economizers use cool outdoor conditions to make chilled water without the compressor.

Liquid cooling for dense racks

As CPU and GPU socket power climbs, air cannot carry the heat out of a dense rack. DOE's guide describes direct liquid cooling with cold plates and single phase or two phase immersion as the main approaches, noting that high performance computing was an early adopter. Liquid loops bring coolant distribution units, leak detection, water quality management and new failure modes. Many new halls are hybrid: liquid to the chip for the dense racks, air for everything else. Our cooling explainer covers chillers and CDUs.

Step 5: measure efficiency with PUE

Power usage effectiveness is total annual facility energy divided by annual IT equipment energy. A PUE of 1.0 would mean every kilowatt hour goes to IT. The Green Grid originally defined PUE and, according to DOE, passed its standardization to ISO/IEC; The Green Grid's consolidated book on the metric dates from February 2014 and covers partial PUE and waste heat reuse.

DOE's best practices guide uses these benchmarks:

Uptime Institute reported that the average annual PUE in its 2022 survey was 1.55, slightly better than 1.57 in 2021, and described progress as in stasis. A quick worked example shows why PUE matters to the budget. Assume a 1 MW IT load running all year at a PUE of 1.4 and an illustrative electricity price of 0.08 US dollars per kWh:

• IT energy: 1,000 kW times 8,760 hours equals 8,760 MWh.
• Facility energy: 8,760 MWh times 1.4 equals 12,264 MWh.
• Overhead (cooling, losses, lighting): 3,504 MWh.
• Annual cost at the assumed price: about 981,000 US dollars, of which about 280,000 is overhead.

Dropping PUE from 1.4 to 1.2 at the same load removes about 1,752 MWh a year. Your tariff will differ; the method will not. Measure PUE over a full year, because a single cool day flatters the number.

Step 6: bring in the network

A data center without diverse connectivity is a very expensive warehouse. Plan for:

• Multiple carriers. At least two, ideally more, with contracts that name the physical route.
• Diverse entrances. Two or more building entrance points with separate duct banks that do not share a trench, bridge or utility pole line. A backhoe can cut both paths if they share one trench.
• A meet-me room. A secured room where carriers terminate and cross connect to tenants or to your own core. TIA-942 defines the cabling spaces (entrance room, main distribution area and so on) and the structured cabling hierarchy that connects them.
• Out of band management. A separate network for BMCs, PDUs, UPS and building systems, isolated from production. Our guide to network segmentation in a data center covers the zones.

Step 7: plan fire detection and suppression

Safety note. Fire protection is life safety work. Detection, suppression, alarm and egress systems must be designed by a qualified fire protection engineer, approved by your local fire authority (the authority having jurisdiction), installed by licensed contractors and maintained on the schedule your code requires. This section is orientation only.

At a planning level, a data center fire strategy usually combines:

• Early detection. Aspirating smoke detection that samples air continuously and can alarm long before a conventional detector.
• Suppression. Pre-action sprinklers, which keep pipes dry until a detector and a sprinkler head both activate, or clean agent gaseous systems for rooms where water damage must be avoided. Gaseous systems need room integrity testing and strict occupant safety procedures.
• Battery rooms. Lithium ion UPS batteries bring specific detection, ventilation and separation requirements that the fire engineer and battery vendor must agree on.
• Emergency power off and procedures. Some codes require an emergency power off arrangement for IT rooms; how it is designed and protected against accidental activation is a code and engineering decision.

In the US, the NFPA standards most often cited for IT spaces are NFPA 75 (protection of information technology equipment) and NFPA 76 (fire protection of telecommunications facilities), alongside the building and fire codes your jurisdiction adopts. We could not fetch NFPA's pages for this post, so check the current editions and how your jurisdiction adopts them with your fire protection engineer.

Step 8: build layered physical security

Physical security protects the people, the equipment and the data. NIST SP 800-53 Revision 5 includes a full Physical and Environmental Protection (PE) control family, which is a good checklist even outside government. CISA's physical security guidance frames the same idea for critical infrastructure. Design in layers:

Shipping and receiving deserves its own procedure, since that is where unexpected hardware enters.

Step 9: get the permits

Permitting is local and varies widely, but the usual set includes zoning or land use approval, building permits, electrical and mechanical permits, fire department approval, air permits for generators, water and wastewater permits for cooling, stormwater and environmental review, and sometimes noise studies. Utility interconnection agreements run in parallel. Start pre-application meetings with the planning department, fire authority and air agency before you close on land if you can, because a denied generator permit or a zoning objection can strand the site. For a longer treatment of approvals and timelines, see how long it takes to build an AI data center.

Step 10: staff the operation

A data center runs every hour of every year. Typical roles:

• Facility manager accountable for uptime, safety and budget.
• Critical facilities technicians (electrical and mechanical) covering every shift, with qualified persons for electrical work.
• Network and IT operations for remote hands, cabling and incident response.
• Security officers for the entrance and patrols.
• Health, safety, environment and compliance owners for permits, generator testing, audits and evidence.

Small sites often contract out generator, UPS and chiller maintenance. Uptime Institute's 2022 survey release cited continuing staffing shortages as a sector challenge, and Cushman and Wakefield's 2026 guide says labour shortages in mechanical, electrical and plumbing trades are raising costs and timelines. Budget for training and for overlap time before go live.

Step 11: build the budget

Construction cost is usually quoted per watt or per megawatt of IT capacity. Two public 2025 to 2026 surveys, from construction and real estate consultancies rather than standards bodies, give a sense of scale:

The two figures are not directly comparable. One is a construction cost index by market, the other an all in development cost that may include land, site work and other items. Either way, a 1 MW facility in a major market is a project in the low to high tens of millions of dollars before IT equipment, and IT equipment for a dense AI hall can cost more than the building. For more, see our cost per megawatt explainer.

A full budget also includes:

• Land, site works and utility contributions.
• Long lead equipment deposits.
• Design and engineering fees, commissioning and testing.
• Operating costs: electricity (see the PUE example), maintenance contracts, fuel, water, staff, insurance, security and audits.

Step 12: plan the timeline

Public timelines vary from months for a modular deployment to several years for a large campus, and utility capacity usually decides which. A typical sequence:

Commissioning deserves the time it needs. Integrated systems testing, where you pull utility power under load banks and watch the whole chain respond, is how you find the faults that only appear when systems interact.

Step 13: operations and compliance

Maintenance and change control

Write a method of procedure for every risky task, follow manufacturers' maintenance schedules, load test generators, and put facility work through change approval. Uptime's 2022 release reported that 60 percent of operators had an outage in the previous three years and that 25 percent of outages cost over 1 million US dollars, so the discipline pays for itself.

SOC 2 and ISO/IEC 27001 as frameworks

Customers of a data center, especially colocation tenants, usually ask for independent assurance. Two frameworks dominate:

• SOC 2 is an attestation report issued by a licensed CPA firm under AICPA standards. It covers controls relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA has recently warned publicly about quick turn SOC engagements and has said it is looking into allegations about a compliance vendor's practices, so choose an established audit firm.
• ISO/IEC 27001 is a certifiable standard for an information security management system, audited by an accredited certification body.

Data centers typically include physical and environmental controls, access logs, CCTV retention, maintenance records and incident response in scope. Our posts on ISO 27001 versus SOC 2 and the SOC 2 trust services criteria go deeper.

Securing the management plane

Building management systems, DCIM software, UPS and PDU network cards, and server BMCs are all network connected computers. Put them on isolated management networks, enforce strong authentication and apply zero trust principles from NIST SP 800-207, which says no implicit trust should be granted based on network location. Patch their firmware on a schedule. Our posts on BMC firmware supply chain risk and motherboard firmware, TPM and BMCs explain why. For hybrid estates, see securing a hybrid data center.

Decommissioning and media disposal

Drives leave the building at end of life, on RMA and when servers are refreshed. NIST SP 800-88 Revision 2, finalised in September 2025, is the US guidance for media sanitization. Write a policy that names the sanitization method for each media type, records serial numbers and keeps certificates of sanitization or destruction. Do not let a failed drive go back to a vendor without a decision on whether it must be destroyed instead. And remember that one building is one failure domain: plan backups and recovery to a second site and test them.

Step by step: an operations toolkit for the first week

Once the hall is live, a few simple scripts make the numbers above visible. These examples are read only and do not change any equipment.

1. Calculate PUE and energy cost from meter readings

Read facility and IT energy from your utility meter and UPS output meters for the same period, then compute PUE and the overhead cost.

# pue.py: compute PUE and overhead cost from two meter readings (kWh)
facility_kwh = 1_021_000   # total facility energy for the month
it_kwh = 730_000           # UPS output or IT PDU energy for the same month
price_per_kwh = 0.08       # your tariff, US dollars

pue = facility_kwh / it_kwh
overhead_kwh = facility_kwh - it_kwh
print(f"PUE: {pue:.2f}")
print(f"Overhead energy: {overhead_kwh:,.0f} kWh")
print(f"Overhead cost: ${overhead_kwh * price_per_kwh:,.0f}")

2. Inventory servers and read inlet temperatures over Redfish

DMTF's Redfish is a RESTful management API that most current server BMCs expose. Use a read only account on the management network. Resource names vary by schema version and vendor, so list first, then drill in.

BMC=https://10.0.10.21          # BMC address on the management VLAN
AUTH='readonly:CHANGE_ME'

# List chassis resources
curl -sk -u "$AUTH" "$BMC/redfish/v1/Chassis" | jq '.Members[]."@odata.id"'

# Firmware inventory (BIOS, BMC, NICs, drives)
curl -sk -u "$AUTH" "$BMC/redfish/v1/UpdateService/FirmwareInventory" | jq '.Members[]."@odata.id"'

# Thermal readings on older schemas; newer ones use ThermalSubsystem
curl -sk -u "$AUTH" "$BMC/redfish/v1/Chassis/1/Thermal" | jq '.Temperatures[] | {Name, ReadingCelsius}'

Compare inlet readings against the 18 to 27 degree C recommended range. Hot spots at the top of racks usually mean missing blanking panels or containment leaks. Use -k only on an isolated lab network; in production, install proper BMC certificates.

3. Record firmware versions where you can query them

Write the Redfish firmware inventory to a file per server and keep it with your asset register, so that when a BMC or BIOS advisory lands you can answer "which machines run that version?" in minutes.

for host in $(cat bmc-hosts.txt); do
  curl -sk -u "$AUTH" "https://$host/redfish/v1/UpdateService/FirmwareInventory?\$expand=." \
    | jq '[.Members[] | {Id, Name, Version}]' > "inventory/$host.json"
done

4. Scan the software you run to operate the site

DCIM tools, monitoring stacks, dashboards and automation scripts are ordinary software with open source dependencies, usually shipped as container images. Scan them the same way you scan application code. With the Safeguard CLI:

# A monitoring or DCIM container image you run on site
safeguard scan --image registry.example.internal/dcim/collector:2.4.1

# The repository holding your automation scripts and dashboards
safeguard scan --dir ./facility-automation

# An SBOM a vendor supplied for a management appliance
safeguard scan --sbom ./vendor-sbom.cdx.json

Results are written as JSON under ./output. This covers software and container images; it does not scan BMC, BIOS or UPS firmware images, which still need each vendor's advisories and update tools.

Where Safeguard fits, honestly

Most of a data center build is concrete, copper, steel and refrigerant, and Safeguard has nothing to do with that. It does not monitor power or cooling, manage devices, scan firmware or protect endpoints. Where it helps is the software layer that runs on top of and around the facility: the monitoring and DCIM applications, automation repositories, internal portals, and the container images that host them. Safeguard builds SBOMs and scans repositories, container images and SBOM files, matches components against vulnerability databases, applies reachability analysis so the vulnerable code paths you actually call come first, shows which projects contain a given component and version, and evaluates policies and gates. Autonomous remediation can open fix pull requests, and it ships switched off so your team chooses what runs on its own.

Common mistakes

• Designing the building before defining the load. Rack density and growth decide cooling and power distribution. Pick them first.
• Buying a Tier label instead of a design. Claiming "Tier III" without Uptime certification, or without concurrent maintainability in practice, damages trust with customers and auditors.
• Assuming two utility feeds equal redundancy. If both feeds come from the same substation or share a route, they fail together.
• Oversizing on day one. Idle chillers and lightly loaded UPS modules waste energy. Build the shell for the end state and fit out in phases.
• Running too cold. Server inlet air far below the recommended envelope wastes energy. Raise set points gradually and measure total energy, including server fans.
• Sharing a trench for "diverse" fibre. Walk the routes. Get the carrier's route maps in the contract.
• Treating fire and electrical work as DIY. Use licensed engineers and contractors and involve the fire authority early. This is a legal requirement as well as a safety one.
• Leaving the management network flat. BMCs, PDUs, UPS cards and BMS controllers on a production or internet reachable network are a common path to trouble.
• Forgetting the software supply chain. DCIM, monitoring and automation tools pull open source dependencies like any other application. If nobody inventories them, nobody patches them.
• No media disposal policy. Failed drives sent back under warranty can carry data. Decide sanitization or destruction per NIST SP 800-88 before the first failure.

FAQ

How much does it cost to build a data center?

Public 2025 to 2026 surveys put it at roughly 11.6 to 15.2 US dollars per watt in major markets, or about 17.6 million US dollars per MW for modern US greenfield sites. IT equipment and operating costs are extra.

How long does it take to build a data center?

From months for a modular deployment on a ready site to several years for a large campus. Utility capacity, permits and long lead equipment such as transformers and switchgear usually set the timeline more than construction does.

What are the four data center tiers?

Uptime Institute's Tier I (basic capacity), Tier II (redundant components), Tier III (concurrently maintainable) and Tier IV (fault tolerant). Uptime says a higher Tier is not inherently better, only suited to different operations.

What is the difference between N+1 and 2N?

N+1 adds one spare unit beyond what the load needs, so the system survives one failure or one unit in maintenance. 2N duplicates the whole system or path, so it survives the loss of an entire side. 2N costs more in equipment and space.

What temperature should a data center be kept at?

ASHRAE's 2021 recommended range for server inlet air is 18 to 27 degrees C (64.4 to 80.6 F) with relative humidity of 8 to 70 percent, as reproduced in DOE's 2024 design guide. Equipment classes A1 to A4 tolerate wider allowable ranges.

What is a good PUE for a data center?

DOE's design guide calls 1.6 standard, 1.4 good and 1.1 better. Uptime Institute reported an average of 1.55 in its 2022 survey. Measure over a full year for a fair figure.

Do I need a licensed electrician to build a data center?

Yes. Electrical design needs a licensed engineer, and installation, testing and maintenance must be done by licensed electricians and qualified persons under your local electrical code and OSHA rules. The same applies to fire protection, which also needs approval from the local fire authority.

What is a meet-me room in a data center?

A secured room where telecom carriers bring their circuits into the building and cross connect to tenants or to the owner's network. It is the hand off point between the outside world and the data center's structured cabling.

Do data centers need SOC 2 or ISO 27001?

Neither is legally required everywhere, but customers and colocation tenants usually ask for one or both. SOC 2 is an attestation report from a licensed CPA firm under AICPA standards; ISO/IEC 27001 is a certification of an information security management system by an accredited body.

Fix it without waiting for upstream

A data center's power and cooling plant is not where Safeguard works, so this section is about the software you deploy and operate inside the building, not the building itself. DCIM and monitoring stacks, automation scripts, management portals and the container images behind them all pull open source components, and a new site usually means installing all of them fresh, which is exactly when vulnerable versions slip in unnoticed.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real terminal session with the Safeguard CLI. It reads a vulnerability finding and its advisory, asks before each command, upgrades a dependency, runs the tests with your approval and pushes nothing. The same flow applies to the automation repositories and dashboards your facility team maintains, such as the scripts that collect Redfish inventory or meter readings.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with a device code and runs scans from the terminal. That suits a management workstation on an isolated out of band network, where you want to scan a DCIM container image or a vendor supplied SBOM without sending source anywhere else.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, an operations engineer can ask which of the site's software projects contain a component named in a new advisory, as long as that software is in your Safeguard inventory.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard at safeguard.sh/download and read the CLI documentation.

Quick check

Sources

• Uptime Institute, Tier Classification System
• Uptime Institute, 2022 Global Data Center Survey press release (20 September 2022)
• TIA, ANSI/TIA-942 Standard
• ASHRAE, Datacom Series and TC 9.9 Datacom Encyclopedia
• US DOE FEMP, Best Practices Guide for Energy-Efficient Data Center Design (revised July 2024)
• US DOE FEMP, Energy Efficiency in Data Centers
• US DOE, DOE Releases New Report Evaluating Increase in Electricity Demand from Data Centers (20 December 2024)
• The Green Grid, PUE: A Comprehensive Examination of the Metric
• US EPA, Stationary Engines (NESHAP and NSPS)
• OSHA, Electrical safety
• NIST SP 800-53 Rev. 5, Security and Privacy Controls
• NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization
• NIST SP 800-207, Zero Trust Architecture
• CISA, Physical Security
• AICPA and CIMA, SOC suite of services
• DMTF, Redfish Developer Hub
• Turner and Townsend, AI data center rush raises alarm over construction supply chain (Data center construction cost index 2025 to 2026)
• Cushman and Wakefield, 2026 Data Center Development Cost Guide

Last reviewed: 23 October 2026.