By Joe Minarik, Chief Operating Officer, DataBank
“Location, location, location.”
While this adage has applied to property values and their overall desirability in traditional, brick-and-mortar real estate markets for generations, this saying can also be used to define success for the next generation of data centers operating at the edge.
To put it another way, where home and commercial real estate markets tend to focus on geography, edge data centers must now carefully factor population proximity into their decisions where to locate, as this will affect latency times. Making the right choices gives data center operators the best chance to deliver fast, reliable, and always-available digital experiences their customers and their end users demand.
Edge Growth Demands New Strategies
This shift in thinking is a response to an edge computing industry that now finds itself at a critical inflection point that may require new variables in strategic decision-making.
Recent estimates project that the total global revenue of the edge computing market will increase nearly tenfold in just seven years – from $16.45 billion in 2023 to $155.9 billion by 2030. Additional research shows that 75% of new data is expected to be created outside of central data centers by the end of 2025.
Both of these findings point to a new dynamic: The fact that the edge computing industry now faces new considerations that outweigh latency metrics and other variables used in the past.
Why Hyperscalers’ Economics Create Population Proximity Gaps
While companies providing digital services have long obsessed over geographic coverage and millisecond improvements, forward-thinking enterprises are now recognizing that population density – not just proximity – represents the true determining factor in their edge infrastructure ROI and overall success.
Hyperscalers face a fundamental economic challenge when it comes to population-dense markets. Their business model depends on massive scale to achieve cost efficiencies, requiring enormous facilities with substantial land footprints and power capacities. In population-dense urban areas, land costs, power infrastructure expenses, and regulatory complexity make these large-scale deployments cost-prohibitive.
This economic reality drives hyperscalers to build their major infrastructure in lower-cost rural or suburban locations where they can achieve the scale economies their model requires. While AWS, Microsoft, and Google could theoretically build in downtown areas, the cost structure doesn’t align with their massive infrastructure requirements and margin expectations.
For edge services specifically, hyperscalers typically rely on virtualized solutions and distributed computing zones that leverage existing telecommunications infrastructure or partner facilities. These software-defined edges – like AWS Wavelength zones, Microsoft Azure Edge Zones, and Google Distributed Cloud Edge – offer broad geographic reach but with limited physical presence in the most population-dense areas where latency matters most.
The Colocation Advantage: Multi-tenant Economics Enable Population Proximity
Colocation data centers solve the population proximity challenge through a fundamentally different economic model. While hyperscalers require massive scale at individual locations to justify their infrastructure investments, colocation providers achieve the necessary scale through multi-tenancy. In doing so, they can successfully spread the cost of population-dense real estate across multiple customers sharing the same facility.
This multi-tenant approach makes the economics work in expensive urban markets where hyperscalers can’t justify dedicated facilities. By serving dozens of customers from a single strategically located data center, colocation providers can absorb the higher costs of prime real estate, power infrastructure, and regulatory compliance that come with being close to major population centers.
The colocation model can deliver better population reach through dedicated physical infrastructure that is positioned where customers need it most. For example, DataBank’s data centers are within a 50-mile radius of 50% of the population in the United States and 100 miles from 60%. This positioning is economically viable because the infrastructure costs are shared across multiple tenants, where each accesses dedicated resources within the same facility.
When a colocation facility positions itself within optimal distance of major population centers, it provides the dedicated processing power, storage, and connectivity that more population-dense applications demand. Unlike hyperscaler edge zones that share resources across larger geographic regions, colocation facilities can dedicate specific capacity to individual customers while maintaining multi-tenant economics that make the location strategy more sustainable.
Most importantly, colocation providers can respond to population growth opportunities through this scalable economic model. As demographics shift and new urban centers emerge, colocation companies can deploy facilities in these markets by leveraging multi-tenancy to justify the higher costs. This approach allows them to capture population proximity advantages through shared infrastructure economics.
Positioning for Edge Computing’s Explosive Growth
As the edge computing market grows from $16 billion to $155 billion by 2030, success will belong to those who understand that location truly is everything. Hyperscalers may offer broad geographic coverage, but colocation providers deliver what matters more: infrastructure strategically positioned within optimal reach of the population clusters that drive tomorrow’s digital economy.
At DataBank, we understand that being a good neighbor means going above and beyond to actively contribute to the communities where we operate. That’s why we’re always looking for meaningful ways to support local organizations and demonstrate our commitment to being a positive community partner.
Recently, a scheduled building demolition on our Culpeper, VA campus presented exactly that kind of opportunity.
An Unexpected Partnership: Turning Teardown into Training
When an old house on DataBank’s Culpeper County property was scheduled for demolition, what seemed like a routine teardown became an opportunity to address a critical community need.
The connection began when both Culpeper County government and the Culpeper County Volunteer Fire Department became aware that the building was due for demolition and reached out to DataBank. What started as a simple inquiry quickly evolved into something much more significant. The chance to provide firefighters with the kind of realistic training opportunity that’s exceptionally rare.
This was an attractive option because Culpeper County lacks a dedicated fire training facility. Their training facilities are located 30-90 minutes away in neighboring counties. This results in taking critical resources outside the county for the duration of the training. While the fire department is occasionally offered buildings for training, most of these structures don’t meet the necessary safety and structural standards required by the Virginia Department of Fire Programs for comprehensive firefighter drills.
“We do have access to training facilities about once a year, but firefighters can get too familiar with those spaces,” said Cody Fairfax, Firefighter and Instructor, Culpeper County Volunteer Fire Department. “The issue is that they tend to know where everything is, which reduces the realism of the training. Firefighters’ skills are perishable, so it’s important that we give them the best training environment possible to enhance their abilities.”
Data Center Community Partnership
DataBank’s building was different. It was in good structural condition and perfectly suited for the advanced training techniques that local firefighters needed to practice.
Rather than simply proceeding with demolition, DataBank worked closely with Culpeper County government representatives to ensure all legal and insurance requirements were met. This enabled the fire department to coordinate a three-day training program that would benefit the entire county.
“This partnership with the Culpeper County Volunteer Fire Department perfectly exemplifies our approach to community engagement,” said Antonia Passalacqua, Public Policy Lead at DataBank. “We’re always looking for creative ways to work with local organizations through meaningful opportunities that deliver real benefits to the communities where we operate.”
The Training Program
The training program followed a three-day “crawl-walk-run” methodology, with a total of 46 volunteers participating, including two other fire companies and career EMS personnel. Each day focused on different training techniques and created progressively more complex scenarios, allowing firefighters to build skills systematically while working in realistic conditions.
The residential building could be customized to change room layouts and possible scenarios each day. This led to a better training environment that couldn’t be replicated in a typical training facility.
The comprehensive nature of the training program allowed firefighters to practice a wide range of critical skills and scenarios:
Structural Operations:
- Vertical ventilation techniques using chainsaws, ladders, and roof access
- Wall breaching for emergency access and egress
- Maneuvering through building studs during rescue operations
Search and Rescue:
- Search and rescue operations using mannequins of different sizes
- Basement exercises to simulate rescue operations in confined spaces
- Hoarder environment simulations with realistic clutter and obstacles
Fire Suppression and Support:
- Hose line advancement in various building configurations
- Water supply operations, including portable water supply systems
- Smoke machine exercises for reduced visibility training
Emergency Response Coordination:
- Rapid Intervention Team (RIT) drills for firefighter rescue scenarios
- Victim treatment and transport coordination with EMS teams positioned outside the building
This type of comprehensive, hands-on training is exactly what firefighters need to maintain their skills and readiness. Yet finding suitable buildings for these exercises tends to be an ongoing challenge for volunteer departments.
A Unique Perspective: From Data Center Manager to Fire Chief
Charles Perryman understands both sides of this collaboration, having spent 39 years as a data center manager while also dedicating time to the Culpeper County Volunteer Fire Department before becoming Fire Chief.
“I’ve rarely seen corporate partners step up like this for public safety training,” said Charles “Jr.” Perryman, Fire Chief, Culpeper County Volunteer Fire Department. “We rarely receive donated buildings from commercial providers, and certainly not from data center operators.
“What DataBank provided was truly exceptional. Not just a building, but a fully coordinated training opportunity that directly enhances our ability to protect our community.”
A compliance audit exception occurs when controls fail to meet regulatory or policy requirements during an audit review.
By Calli Schlientz, Director of Compliance, DataBank
What They Are, Why They Matter, and How to Respond
Compliance audits are a critical component of organizational governance, designed to ensure that companies adhere to established policies, procedures, and regulatory requirements. However, even the most well-intentioned organizations may encounter situations where actual practices don’t align perfectly with documented standards.
What Is an Audit Exception?
A compliance audit exception is a finding or deviation and occurs when an auditor, either internal or third-party (external), identifies a discrepancy or deviation from defined policies or procedures or required control parameters. Ultimately, this means something went wrong and what is required is not what is actually happening.
There are four key areas of an exception:
- Nonconformance: The activity or evidence that did not meet the defined policy or compliance requirements (control).
- Impact: The exception represents some sort of risk, inefficiency, or security vulnerability.
- Documentation: The exception is formally documented by the auditor within the audit/assessment report.
- Remediation: The organization receiving the exception is required to address the issue and implement corrective actions. Typically, this is done in the form of a management response, root cause analysis, and corrective action plan. These actions could be taken to correct the error, mitigate (or partially reduce the risk), or accept the risk posed by the deviation.
The following are real-life examples that might trigger these types of exceptions:
- A terminated user account that wasn’t disabled within the documented service-level agreement (SLA) for that system.
- An accounting process to change an ACH recipient was completed without validation and second-party verification as required by documented policies or procedures.
- Configurations were not aligned with approved security baselines (e.g., firewall rules, system hardening, etc.).
- Fire inspections that weren’t conducted within the annual timeline requirement.
Why Do Audit Exceptions Matter?
Audit exceptions, or non-conformities, matter because they highlight potential or actual weaknesses or failures in processes, policies, or controls. If they are left uncorrected, they can have a significant impact on the organization, and potentially, its customers. Additionally, an exception or non-conformity outlines what is not being done: where data is not protected, or where access points are weakened and easily exploited (physically or logically).
Depending on severity, these exceptions can:
- Signal systemic process or training issues
- Affect audit opinions, resulting in a qualified or adverse opinion:
- Qualified: Everything is fairly presented except for a specific area where there is a limitation or deviation (“Mostly Compliant”).
- Adverse: There are issues so serious that the report does not fairly present the organization’s controls (“Non-Compliant”).
- Affect customer trust.
- Impact customers’ or DataBank’s regulatory standing.
- Lead to noncompliance penalties or overall audit failures.
- Contribute to security breaches.
- Result in financial loss due to incident cost, reputation damage, and customer turnover.
- Cause business disruptions (which, if exploited can result in costly incidents).
How Should Organizations Handle Audit Exceptions?
Audit exceptions should be addressed in a timely manner with a well-documented and transparent response. One best-practice response is to follow a few steps that are well defined and repeatable (not that you want to have to repeat them).
Step 1: Validate and respond to the exception
- Upon communication from the assessor, do not react immediately, but rather review it. Review internal data and documentation to validate the alleged exception.
- Document for management all the data gathered during the internal investigation as part of the validation.
- Draft a response for management’s review to respond to the alleged exception.
Step 2: Acknowledge the exception
- Document the exception and management’s response to the exception by including what control(s) or processes were involved, a description of the issue, the date of discovery, and impact to the organization or system (risk level, all affected systems).
Step 3: Perform a root cause analysis (RCA)
- Determine the reason why the control failed.
- Consider if the failure was a process gap, human error, lack of resources or training, technical failure, system failure, vendor, or supply chain issue, etc.
- Document the root cause and how it was determined.
Step 4: Create a corrective action plan (CAP)
- Define specific steps to correct the issue, including:
- Identifying the owner – who is responsible for each part of the correction.
- Establishing the timeline for each step of the resolution.
- Creating specific milestones – key points within the correction that should be targeted and any dependencies for each of these.
- Documenting any changes to policy, procedure, or systems that are a result of this exception and action plan.
TIP: Your CAP should be auditor-ready and clearly assign responsibility and deadlines.
Step 5: Communicate transparently
- Be honest with stakeholders. Customers and partners value remediation and accountability more than silence.
What to Look for in a Provider’s Audit Report
When reviewing a provider’s audit report, there will inevitably be several key red flags and confidence indicators within it. These should be brought up as part of each review, typically held annually, of all of your organization’s critical vendors. It is important to look for these, but if you have any questions, be sure to ask key vendors about exceptions and corrective action plans.
Where you’ll see exceptions documented:
- SOC 1/SOC 2 reports
- PCI-DSS ROC (Report on Compliance)
- NOTE: Most providers will only give the Attestation of Compliance so ask for details related to areas of non-compliance
- ISO 27001 certificates and reports
- FedRAMP SAR (Security Assessment Report), RET (Risk Exposure Table), and POA&M (Plan of Action and Milestone) documents, which are accessible only through Connect.gov through the FedRAMP Access Request Process for those with a .mil or .gov email address.
Key evaluation factors:
- Severity: Does the exception affect sensitive data or privileged access?
- Frequency of numbers: Is it a one-time lapse, a single incident in a sample stack, or a recurring failure?
- Cumulative numbers: Is the report littered with exceptions, or are there just one or two?
- Remediation timeline: Is there a clear plan with ownership and due dates?
- Management response: Is the organization proactive in resolving and documenting the issue?
- Audit opinion: Is the audit opinion clean (unqualified) or qualified/adverse?
Ask this: “What actions has the provider taken since this exception was discovered?”
After collecting all of the data, your organization can make an informed decision on the level of risk that may impact your overall operations and whether or not a key vendor fits within your risk appetite.
Final Thoughts
Compliance audit exceptions are not just check-the-box findings as part of a larger compliance program. They are indicators of where systems, processes, or behaviors have deviated from expectations. Whether the result of human error, outdated procedures, or technical gaps, exceptions give organizations the opportunity to improve. When approached with transparency, accountability, and a structured response, exceptions can drive real progress toward a stronger security and compliance posture.
For both organizations and their partners, how exceptions are identified, managed, and resolved speaks volumes about operational maturity and risk awareness. Ultimately, a proactive approach to audit exceptions isn’t just about passing, it’s about building resilience, trust, and long-term success.