Loading...
Loading...
Independent, multi-standard risk assessments for colocation, telco edge, hyperscale and managed-service facilities. Built for BNM RMiT, NACSA NCII and Tier-III/IV tenant assurance.
Facility-level holistic review. Physical, environmental, electrical, mechanical, fire, network, cyber. The full picture.
Focus on the logical and physical network — inter-site, carrier diversity, segmentation, BGP and edge-routing resilience.
Formal MAS/IMDA-style methodology. Threat actor catalogue, vulnerability enumeration, residual-risk computation post-controls.
Malaysia is in the middle of an unprecedented data-centre buildout — Johor alone has more than 1.6 GW of announced capacity, with operators including Bridge, Princeton Digital, AirTrunk, Equinix and the hyperscalers all scaling simultaneously. Tenants moving FSI, healthcare and NCII workloads into these facilities need third-party assurance that physical, environmental and cyber controls actually work as documented.
And for operators, an independent DCRA / TVRA is increasingly the price of entry for BNM-regulated FSI tenants under RMiT 10.51 outsourcing rules and for NCII tenants under the Cyber Security Act 2024.
DCRA (Data Centre Risk Assessment) is a holistic, facility-level risk review covering physical, environmental, electrical, mechanical, fire-suppression, network and cyber controls. NRA (Network Risk Assessment) focuses on the logical network and inter-site connectivity. TVRA (Threat, Vulnerability and Risk Assessment) is the formal MAS-style methodology covering threat actors, vulnerabilities, and the residual risk after controls — often a regulatory requirement for FSI-hosting data centres.
There is no single Malaysian statute that mandates TVRA by name, but it is effectively required when the facility hosts BNM-regulated FSI workloads (RMiT 10.51 references), MAS-regulated workloads under Singapore TRM, or NCII workloads under the Cyber Security Act 2024. Most Tier-III and Tier-IV operators perform DCRA or TVRA every 24 months as a customer-contractual obligation.
Colocation and hyperscale operators (preparing for FSI / NCII tenants), telcos building edge sites, managed service providers consolidating customer workloads, cloud-region buildouts requiring third-party assurance, and tenants performing pre-move-in due diligence on a prospective facility.
TIA-942 (telecommunications infrastructure standard), Uptime Institute Tier framework, ISO 27001 Annex A.11 (physical controls), Singapore SS 507 (best-practice business continuity / DC), MS ISO/IEC 27017 (cloud security), BNM RMiT 10.51 (FI outsourcing technology services), and the NACSA Cyber Security Act 2024 NCII code of practice.
A Tier-III single-site DCRA typically runs 4-6 weeks: kickoff and document review (week 1), on-site walk-down and interviews (week 2-3), analysis and risk modelling (week 4), draft report and client review (week 5), final report and presentation (week 6). Multi-site or NCII-scoped engagements run 8-12 weeks.
Single-site or multi-site, DCRA / NRA / TVRA, fixed-price proposals inside 3 business days.
Get a Scope