Analysis of Territorial Risks and Protection Factors for the Business Continuity of Data Centers

Round 1

Reviewer 1 Report (Previous Reviewer 1)

I suppose this paper appears to be a resubmission of a previous version with improvements (in red).

Reading the Introduction, I still couldn't get the motivation and objective of the proposed paper. Some methodological aspects of a scientific paper are missing. For example, the first paragraphs do not have any references. For example, the NIS2 is only referenced in section 3 [9] (page 3), but it is mentioned in line 46. The absence of references is the main issue while motivating the problems to be tackled.

Moving on, I tried to figure out this research's objective and problem. The authors affirm that a group of researchers from the Politecnico of Milan carried out a risk assessment, which generated a "methodological framework to assess the exposure, vulnerability, and resilience of data centers to external threats following a multi-risk approach (...)". What are the objectives of this paper? Let me try to help: are the authors from the Politecnico of Milan, and is the objective to present the developed framework? Did the authors publish it before? What does the framework do, and, more important, how does it do it? What is the definition of a multi-risk approach?

After that, the authors present the paper structure. So, several open points should be presented and motivated before. As said before, the authors must clearly highlight this manuscript's problems, objectives, and contributions.

Regarding the literature review and state-of-the-art sections, I understood the absence of works considering territorial risks. Sometimes is hard to motivate when there is a lack of publications scientifically. In this case, and as I said before, the authors should provide a systematic review (maybe a mapping) of the area to guarantee the novelty of the methodology. The reproducibility of systematic reviews using scientific databases will corroborate the authors. Section 2 is the perfect spot for this.

In Sections 4 and 4.1, the authors discussed related cases (what I understand as related works) that motivate the framework proposal. Definitely, these sections should be in the Related Work or sate-of-the-art Section. Section 4 (i.e., 4.2) should focus only on the framework. In this section, the authors should present the framework's purpose with more details before explaining the structure (Figure 2). The authors describe the framework purpose between lines 316 and 322. But I suggest inserting a brief explanation of how to use the framework.

As I could see, the paper has improved. However, the presentation and the methodological aspects still need enhancements. In this version, I could see the framework's usage and contributions. So, I hope these suggestions can help the authors improve the manuscript.

Author Response

Reading the Introduction, I still couldn't get the motivation and objective of the proposed paper. What are the objectives of this paper? Let me try to help: are the authors from the Politecnico of Milan, and is the objective to present the developed framework? Did the authors publish it before? What does the framework do, and, more important, how does it do it? What is the definition of a multi-risk approach? the authors must clearly highlight this manuscript's problems, objectives, and contributions.  We have addressed this point that has been raised by creating a new section, section 2 titled problem framing. In this section we explain more precisely what is the problem that has been posed to the researchers.

Some methodological aspects of a scientific paper are missing. For example, the first paragraphs do not have any references. For example, the NIS2 is only referenced in section 3 [9] (page 3), but it is mentioned in line 46. The absence of references is the main issue while motivating the problems to be tackled. Sometimes is hard to motivate when there is a lack of publications scientifically. In this case, and as I said before, the authors should provide a systematic review (maybe a mapping) of the area to guarantee the novelty of the methodology. The reproducibility of systematic reviews using scientific databases will corroborate the authors.  First of all in the problem framing we did refer to published literature including peer review papers (that are still not many but are referred to). Then section 4 is still divided in two parts, the first relates to the literature review (4.1). In this case we have added a literature search carried out in Scopus, Web of Science and ScienceDirect databases. The literature review search has been coherent with the problem framing as in section 3, therefore it is not generically related to data centers safety and reliability but to the relationship between data centers and locational factors in areas that are exposed to different kinds of hazards, including multihazard situations. 

In Sections 4 and 4.1, the authors discussed related cases (what I understand as related works) that motivate the framework proposal. Definitely, these sections should be in the Related Work or sate-of-the-art Section. Section 4 (i.e., 4.2) should focus only on the framework. In this section, the authors should present the framework's purpose with more details before explaining the structure (Figure 2). The authors describe the framework purpose between lines 316 and 322. But I suggest inserting a brief explanation of how to use the framework. We have followed the suggestion of the third reviewer: we have moved the part on the case studies of data centers disruption during extreme events in 3.3. so completing the state of the art part. Accordingly we have changed the title of Section 3 to make it more coherent with the content. Finally we have added some parts with table 4 and figure 3 to better explain the process needed to apply the methodology that is proposed in Section 4.

Author Response File: Author Response.pdf

Reviewer 2 Report (New Reviewer)

The article is interesting thematically, however, the rigors of the scientific paper should be refined in two aspects:

1.      Clear definition of the issues at the beginning of the study, which are present throughout the content (1. Introduction).

2.      Describing the scheme of the conducted literature review and, as a result, describing the subject based on previous publications (2. Literature Review).

 

Regarding topic no. 1.

In the initial part of the article, the terms used in the article should be defined: risk, hazard, treat, vulnerabilities, factor, resilience, continuity.

An unambiguous approach to individual issues will be easier for the reader to understand, maintain a scientific approach and allow for the perception of practical actions in data centers.

It is also worth showing the semantic relations between them, because in the article they are used in various spatial meanings, for example: factor and resilience.

 

“Factor”: Risk factors (line no. 47), safety factor (145), environmental factors (170), natural hazards factors (225), competing organizational factors (285), vulnerability factors (511), protective factors (512).

 

“Resilience” in lines:

-        24-25: the entire resilience cycle

-        54: resilience of data centers

-        109-110: the resilience of data management services

-        132: resilience management

-        216, 218: Resilience thinking

-        347: the resilience of the territory and critical services

 

In the subject of "resilience" I can recommend, among others:

-        Chen, R.; Xie, Y.; Liu, Y., Defining, Conceptualizing, and Measuring Organizational Resilience: A Multiple Case Study. Sustainability 2021, 13, 2517. https://doi.org/10.3390/su13052517

-        Liu, Y.; Chen, R.; Zhou, F.; Zhang, S.; Wang, J. Analysis of the Influencing Factors of Organizational Resilience in the ISM Framework: An Exploratory Study Based on Multiple Cases. Sustainability 2021, 13, 13492.
https://doi.org/10.3390/su132313492

 

Regarding topic no. 2.

In lines 110-113 there is a sentence: “However, it must be pointed out there is not an extended literature on the protection of data centers against natural hazards and climate change nor specific case studies published in peer reviewed journals on both the hazards and the vulnerabilities that affect them.”

In lines 226-227 there is a sentence: “An extended overview of such factors was developed using literature…”

 

I am not convinced that after extended literature review it can point out "there is not an extended literature on the protection of data centers".  It is necessary to show/describe the research path within extended literature review with results and conclude after that in-depth process.

 

For example, using the EBS (EBSCO Discovery Service) metasearch engine showed many articles on the topics covered. I used the following search criteria:

- only the last years 2020-2023 (due to the increased importance of the issues described since Covid-19),

- only scientific journals,

- online full text only,

- English,

- searching for articles only by words appearing in the titles of papers.

Results:

for “data center risk” in the titles, there are 130 articles.

for “data center factor” in the titles, there are 104 articles.

For “data center resilience” in the titles, there are 7 articles (and quite interesting: Xiahou, X.; Chen, J.; Zhao, B.; Yan, Z.; Cui, P.; Li, Q.; Yu, Z. Research on Safety Resilience Evaluation Model of Data Center Physical Infrastructure: An ANP-Based Approach. Buildings 2022, 12, 1911. https://doi.org/10.3390/buildings12111911)

 

Technical aspects:

-        the text is "red" in many places – unnecessarily

-        in lines 198-199 there is a doublet of the words “must have specific characteristics”

-        in line 234 there is “double space” between (Figure 1). and Moreover.

Author Response

Clear definition of the issues at the beginning of the study, which are present throughout the content (1. Introduction). In the initial part of the article, the terms used in the article should be defined: risk, hazard, treat, vulnerabilities, factor, resilience, continuity. It is also worth showing the semantic relations between them, because in the article they are used in various spatial meanings, for example: factor and resilience. In the subject of "resilience" I can recommend, among others:  Chen, R.; Xie, Y.; Liu, Y., Defining, Conceptualizing, and Measuring Organizational Resilience: A Multiple Case Study. Sustainability 2021, 13, 2517. https://doi.org/10.3390/su13052517 - Liu, Y.; Chen, R.; Zhou, F.; Zhang, S.; Wang, J. Analysis of the Influencing Factors of Organizational Resilience in the ISM Framework: An Exploratory Study Based on Multiple Cases. Sustainability 2021, 13, 13492. https://doi.org/10.3390/su13231349 We have not fully followed this point as we believe the literature that we quote, in particular Menoni et al 2007, Bonadonna et al 2020 fully provide a definition of terms such as risk, vulnerability etc. We believe it would be extremely difficult to follow the article, that is already addressing a complex and new topic, if we introduce also a sort of glossary. However we did make a reference to the UNDRR glossary that is now becoming more or less an internationally agreed upon standard. Where we addressed the concept of resilience we did make a reference to the first suggested article in this part (line 416) 

Describing the scheme of the conducted literature review and, as a result, describing the subject based on previous publications (2. Literature Review). It is necessary to show/describe the research path within extended literature review with results and conclude after that in-depth process. For example, using the EBS (EBSCO Discovery Service) metasearch engine showed many articles on the topics. This has been fully done in Section 3.1.

Technical aspects: - the text is "red" in many places – unnecessarily - in lines 198-199 there is a doublet of the words “must have specific characteristics” - in line 234 there is “double space” between (Figure 1). and Moreover. As the article has been changed in several places those elements have been either removed or corrected. However the configuration of the article is different from the reviewed one at least as far as individual points are concerned.

Author Response File: Author Response.docx

Reviewer 3 Report (New Reviewer)

The analysis of territorial risks and protection factors for data centers is  interesting and important topic. However, I cannot find  an adequate scientific analysis of the territorial risks and protective factors in the manuscript. Thus, the study does not increase scientific knowledge in this area. Instead, the authors try to prove their thesis based on observations- their background knowledge and existing reports, not necessarily supported by scientific evidence.

The introduction does not include references- which is very strange in a scientific paper. The introduction needs to engage readers, explaining why their research topic is worthy of study. They need to show, not just tell. It means they have to provide adequate background information on the topics (that need to be highlighted) and the purpose of the study. Authors need to introduce the main topics without going into too much detail. A clearly stated research question is also lacking.

A solid theoretical background in the study is missing. The authors extensively describe the context of the study with reference to reports and international standards. However, it is only an overview. While existing standards and reports are important material for further analysis of the study, they are not academic kinds of literature.  

 

Without a solid theoretical background, clearly defined methodology and traceability, the manuscript is ready to be published in a scientific journal. The key terms must be clearly defined (e.g., risk, vulnerability, systemic approach, etc.). Which data types are used (as I see in the current document- it seems to be just secondary data)? How do authors gather data? In lines 216-217, the authors mention that: […] resilience thinking was at the core of the discussions between the plant safety managers and the researchers and inspired the development of the methodological framework. This is very important to be further elaborated. Was it formal? Informal? How was the conversion process? How it inspired the authors, and when? 

The overall feedback: 

- Consider emphasizing the research rationale and structuring the manuscript more clearly.

- The language of the paper is relatively unclear. Think about the sentence length. For instance, the Goal (lines 17- 20) is too long and confusing.

- Mixing citation styles is not recommended; e.g., in line 78, you refer to: Lujif and Klaver (2021) [2], which is two different citation styles.

- Critically important to refer to the original document. For instance, Table 1. Data centers classification according to levels of availability is adopted from the following link: https://serviceexpress.com/resources/understanding-data-center-tiers/  Important that reference is addressed in the title, saying where the table is adopted from.

- Important that you focus on your message. Line 78 states: 'for most of the others […]. Who are the others? Or which types of exercises do you refer to when you state in line 80: much more central than in previous similar exercises.

 

Author Response

I cannot find an adequate scientific analysis of the territorial risks and protective factors in the manuscript. Thus, the study does not increase scientific knowledge in this area.  We have addressed this point that has been raised by creating a new section, section 2 titled problem framing. In this section we explain more precisely what is the problem that has been posed to the researchers.

The introduction does not include references - which is very strange in a scientific paper. The introduction needs to engage readers, explaining why their research topic is worthy of study. They need to show, not just tell. It means they have to provide adequate background information on the topics (that need to be  highlighted) and the purpose of the study. Authors need to introduce the main topics without going into too much detail. A solid theoretical background in the study is missing. The authors extensively describe the context of the study with reference to reports and international standards. However, it is only an overview. While existing standards and reports are important material for further analysis of the study, they are not academic kinds of literature. First of all in the problem framing we did refer to published literature including peer review papers (that are still not many but are referred to). Then section 4 is still divided in two parts, the first relates to the literature review (4.1). In this case we have added a literature search carried out in Scopus, Web of Science and ScienceDirect databases. The literature review search has been coherent with the problem framing as in section 3, therefore it is not generically related to data centers safety and reliability but to the relationship between data centers and locational factors in areas that are exposed to different kinds of hazards, including multihazard situations. 

The key terms must be clearly defined (e.g., risk, vulnerability, systemic approach, etc.).  We have not fully followed this point as we believe the literature that we quote, in particular Menoni et al 2007, Bonadonna et al 2020 fully provide a definition of terms such as risk, vulnerability etc.

Which data types are used (as I see in the current document- it seems to be just secondary data)? How do authors gather data? In lines 216-217, the authors mention that: […] resilience thinking was at the core of the discussions between the plant safety managers and the researchers and inspired the development of the methodological framework. This is very important to be further elaborated. Was it formal? Informal? How was the conversion process? How it inspired the authors, and when?  In the informal discussion to the development of the methodological resilience thinking, resilience was intended as the ability to absorb shocks and preserve the functioning of the organization, to recover from unexpected events.

Consider emphasizing the research rationale and structuring the manuscript more clearly We have moved the part on the case studies of data centers disruption during extreme events in 3.3. so completing the state of the art part. Accordingly we have changed the title of Section 3 to make it more coherent with the content. Finally we have added some parts with table 4 and figure 3 to better explain the process needed to apply the methodology that is proposed in Section 4.

The language of the paper is relatively unclear. Think about the sentence length. For instance, the Goal (lines 17- 20) is too long and confusing. In the revised paper, we formulate a synthetic goal in the introduction. 

Mixing citation styles is not recommended; e.g., in line 78, you refer to: Lujif and Klaver (2021) [2], which is two different citation styles. In the revised version, we use a citation styles

Critically important to refer to the original document. For instance, Table 1. Data centers classification according to levels of availability is adopted from the following link:https://serviceexpress.com/resources/understanding-datacenter-tiers/ Important that reference is addressed in the title, saying where the table is adopted from. We insert source [25] (ANSI/TIA-942. Telecommunications Infrastructure Standard for Data Centers. Telecommunications Industry Association, April 2005) for TABLE 2 - Data centers classification according to levels of availability.

Important that you focus on your message. Line 78 states: 'for most of the others […]. Who are the others? Or which types of exercises do you refer to when you state in line 80: much more central than in previous similar exercises. We insert source in order [2] (Luiijf, E.; Klaver, M. Analysis and lessons identified on critical infrastructures and dependencies from an empirical data set. International Journal of Critical Infrastructure Protection 2021, 35) to explain it

Author Response File: Author Response.docx

Round 2

Reviewer 1 Report (Previous Reviewer 1)

This version of the paper has significantly improved, which is positive. My main concern still stands on the Introduction.

The Introduction is an important section of a research paper. It helps the readers to understand the whole picture of what is being presented and proposed. It must address the motivation and domain, the existing problems and some related works, the objective and how the authors intend to achieve it, how it will be tested and proved, the paper's contributions, and the structure of the paper. As I stated before: "the authors must clearly highlight this manuscript's problems, objectives, and contributions." Despite other Sections for Related Works and problems, the Introduction should highlight the problem and all those information. Besides, it helps other researchers to assess that information easily before reading the paper.

It is still unclear (in the text) if the authors are from the Politecnico of Milan and if the objective is to present the developed framework produced by the risk assessment (carried out by the authors). I think so. Nevertheless, as I stated before, it should be clear. Particularly, I see this information as a significant achievement that should also be highlighted. I am enthusiastic about research works originating from companies.

In my opinion, these adjustments will increase the paper's visibility and facilitate other researchers when they read it.

I hope I could help a little bit. Congratulations on the work.

Author Response

In the new revised paper, we improve and reorganize a bit the introduction section considering the provided suggestions, in particular stating 1) manuscript's problems, 2) objectives, and 3) contributions.  Moreover, we put in evidence that the paper is a result of from a collaborative effort of the research team of the Politecnico di Milano and the experts working for IBM and Kyndryl who are signing together this article. 

Reviewer 3 Report (New Reviewer)

Thank you for the opportunity to review this study. I was happy to see that the authors have considered my comments from the first round of reviews. The revised manuscript provides a clear and concise overview of the importance of telecommunications and data centers.  Authors’ literature review  is conducted in a systematic and thorough manner. The use of multiple databases and a set of specific search criteria is a good practice that helps ensure that relevant sources are identified.  The framework proposed as ‘Figure 2 - Conceptual scheme’ combined with the table 3, is well thought-out and takes into account the complexities of the interactions between the data centers and their environment.

Author Response

Thanks for the provided suggestions and comments helping us to improve the final version of the paper!

Round 3

Reviewer 1 Report (Previous Reviewer 1)

I think it is ok. Congrats.

This manuscript is a resubmission of an earlier submission. The following is a list of the peer review reports and author responses from that submission.

Round 1

Reviewer 1 Report

The paper presents an analytical methodology for data centers' business continuity. The authors motivate the necessity of their new methodology by explaining existing normative approaches outside academia.

The first paragraph has more than 20 lines. In line 52, there is an unnecessary space between words networks and reverberating, and between words avoiding and physical, in line 179 (The authors should revise the paper thoroughly to find other instances like that). Considering a research paper, Figure 1 is trivial for the audience. I suggest removing it. Please, add a paragraph with the paper's structure. Figure 3 should be improved. Its quality is not appropriate. Table 2 comprises three pages. It is tough to follow it. The paper sound more like an analysis than a methodology. So, Section 4 needs more details and comparisons. The authors must highlight the contributions of this manuscript in comparison to the ones mentioned above.

The authors affirm that in a previous article that they "describe the process leading to the development of a such methodology that required a continuous interaction between the safety managers of IBM and then Kyndryl and the university researchers." I couldn't find a reference describing this approach. This is a critical issue to define if exists rather or not novelties in the approach.

The problem that the authors are tackling must be highlighted. The paper lacks related works and proper references. The introduction is where the authors should emphasize it.

Sections 2 and 3 are very interesting, in my opinion. If the authors intended to use them as Related Works, they should be adequately organized (and compared) in a proper section. Are there other papers that proposed methodologies and similar approaches? As a research paper, I would like to see what other researchers are doing compared to the proposed methodology. There are only five papers in the References section. The author should provide a review (mapping or systematic) of the area to guarantee the novelty of the methodology.

Is there any Future Work? A discussion in this way should add value to the authors' paper.

There are some typos and grammar issues, such as "available literature is still scares." The paper must be revised considering the English language. There is a lot of "accessed on Day Month Year."

Reviewer 2 Report

1.too much content for the literature review. This is a 19-page article. The first 10 pages are repeating similar content of the background and what the authors have done. 

For example, in line 62: "In the article we describe the process leading to the development of such methodology that required a continuous interaction between the safety managers of IBM and then Kyndryl and the university researchers." 

In line 78: " this paper aims at outlining an overall and updated methodological framework to assess their exposure, vulnerability and resilience to external 79 threats..." 

In line 81: "In the paper a multihazard multirisk assessment methodology is proposed to consider the systemic links between data centers and the external natural and 82 built environment, including the multiple interdependencies with other critical infrastructures. "

The first 10 pages can be compressed into a half page: The data center is important... Several existing certification methods and standards have been proposed for .... In this paper, the authors proposed a new analysis framework of territorial risks and protection factors for data centers, which is adapted from the Dow method.

2.in a 19-page article, only one figure and one paragraph on page 9 describe the proposed framework. And the figure is full of unclear text. Instead of listing possible risks in the table, a more detailed discussion of the framework must be explained.

3. poor evaluation. The case study in Section 4.1 does not explain the usage of the proposed framework. It's easy to get the same results by simply analyzing several common risks of the data centers without using the proposed framework. I cannot see any relationship between the case study and the proposed framework. More importantly, the authors claimed that the framework is for data centers' business continuity. In Section 4, the discussion of the framework is not related to business continuity. 

4.poor conclusion. Lack of support for the conclusion.

5.Figure 1 is not relevant to the whole article.

6.the authors referenced too many online reports. Lack of research articles for the references.