When you place servers in a colocation or managed data centre, the provider's staff, contractors and building systems gain physical access to hardware that holds your data, keys and management interfaces, yet facility selection is often run by facilities and finance teams on power price, space and connectivity alone. Physical access defeats most logical controls: a person in the cage can plug into a console port, swap a disk, or attach a device to a management network. This vendor-neutral guide sets out the security requirements to write into a colocation, wholesale or managed data centre selection: certifications and their scope, physical zoning, access and remote hands processes, monitoring evidence, resilience, connectivity, media handling, contract terms and exit. It is for security architects, infrastructure leads, risk teams and procurement. It covers selection only; for the controls inside a facility you operate, see the Data Centre Security Guide.
Key takeaways
- Read the scope, not the badge. An ISO/IEC 27001 certificate or SOC 2 report only helps if the named site, the physical security controls and the services you buy (remote hands, cross-connects) are in scope.
- Every person who can touch your rack is in your threat model. Require named access lists, multi-factor entry to the data hall and cage, escorted visitors, and a remote hands process that needs your ticket before anyone opens your equipment.
- Evidence must be available after an incident. Access logs and CCTV covering your cage, with stated retention and a way to request them, decide whether you can investigate tampering.
- Resilience ratings describe power and cooling, not security. Uptime Institute Tiers and similar ratings are about availability; assess physical security separately, for example against EN 50600-2-5 Protection Classes.
- Protect what you put in, and what you take out. Locked racks, tamper evidence, encrypted disks and a documented media destruction and exit process limit the damage when physical controls fail.
Define requirements
Start with what will sit in the facility and what it is worth to an attacker. Then record:
- Service model: retail colocation (racks or cages in a shared hall), wholesale or private suites, or a managed data centre service where the provider also operates your hardware. Each step towards managed service gives provider staff more logical as well as physical access.
- Assets and data: production servers, storage arrays, network edge, HSMs, backup and tape libraries, and out-of-band management equipment. HSMs and key material need stricter access than general compute.
- Required protection level: the zoning depth and entry controls you expect for the building, data hall and your own space. For European facilities, EN 50600-2-5:2021 defines four Protection Classes for access to spaces, and applies the same Class 1 to Class 4 structure to intrusion, fire and environmental protection; use it to state requirements precisely.
- Resilience target: the availability you need, expressed in terms the market uses (Uptime Institute Tier or ANSI/TIA-942 rating) and in recovery objectives that your own architecture must still meet.
- Location constraints: jurisdiction, distance between primary and secondary sites, flood and other hazard exposure, and any data residency rules.
- Regulatory drivers: data centre service providers are listed under digital infrastructure in Annex I of the NIS2 Directive (EU) 2022/2555, so in-scope EU providers carry their own obligations; your sector rules (payment card, health, financial services, government) may also set physical security requirements you must pass down. See the NIS2 Directive Guide.
Capability areas
| Capability area | Minimum requirement | Why it matters |
|---|---|---|
| Certification and assurance | ISO/IEC 27001 certificate naming the site, SOC 2 Type II report covering security and availability for the site, sector attestations you rely on | Independent evidence the controls operate, not only exist (SA-9, CA-2) |
| Physical zoning | Layered perimeter: site boundary, building, data hall, cage or suite, rack; each layer with its own access control | Depth slows and records an intruder (ISO/IEC 27001 Annex A 7.1, PE-3) |
| Entry control | Two-factor entry to data halls (card plus PIN or biometric), anti-tailgating at hall entry, man-trap or equivalent, customer-specific cage access | Cards alone are lent, cloned and lost |
| Access authorisation | Customer-maintained access list, named approvers, same-day removal, visitor pre-registration and escort, periodic access list reconciliation | The access list is an identity system you depend on (PE-2, PE-3) |
| Monitoring and evidence | CCTV covering entrances, halls and aisles to your space, stated retention, access logs available on request, 24x7 staffed security | Needed to investigate tampering (PE-6; ISO/IEC 27001 Annex A 7.4) |
| Remote hands | Work only against a ticket raised by an authorised customer contact, identity of the technician recorded, photographic or video evidence on request | Remote hands staff are privileged users of your hardware |
| Power and cooling | Redundancy matching your target (Tier or rating certified by an independent body), generator fuel autonomy, tested transfer, monitored environment | Availability is a security outcome (PE-11, PE-14; CSF PR.IR-02) |
| Fire and water | Early detection, suppression suited to IT equipment, leak detection, documented evacuation and shutdown procedures | PE-13, PE-15 |
| Connectivity | Carrier-neutral options, diverse building entry, secured meet-me rooms, documented cross-connect process | Cabling and cross-connects are a physical attack path (ISO/IEC 27001 Annex A 7.12) |
| Facility systems security | Building management, DCIM, CCTV and access control systems segmented from customer networks, patched, with MFA for administrators | Facility systems are networked and can be attacked remotely |
| Media and decommissioning | Customer-controlled media removal, on-site destruction option, chain of custody records | Disks that leave the building are data that leaves the building (ISO/IEC 27001 Annex A 7.14) |
Resilience ratings and what they do not tell you
| Scheme | What it rates | What it does not cover |
|---|---|---|
| Uptime Institute Tier I to IV | Infrastructure topology from basic capacity (Tier I) through concurrently maintainable (Tier III) to fault tolerant (Tier IV), plus operational sustainability | Access control, CCTV, personnel security, logical security of facility systems |
| ANSI/TIA-942 (current revision TIA-942-C) | Site location, architectural, electrical, mechanical, fire safety, telecommunications and security requirements | Your own cage and rack controls, remote hands procedures; check which revision and rating a certificate refers to |
| EN 50600-2-5:2021 | Physical security: Protection Classes 1 to 4 for unauthorised access, intrusion, fire and environmental events | Power and cooling redundancy (other parts of the series) and logical security |
| ISO/IEC 27001 and SOC 2 | Operation of an information security management system or of stated controls over a period | Anything outside the stated scope; a SOC 2 Type II covers a period, so check dates |
Ask whether a Tier or rating is a design certification or a certification of the constructed, operating facility; a design certificate alone says nothing about how the site is run today.
Evaluation criteria
Weights are an NHI Mgmt Group suggestion; adjust for your assets. Score 0 to 3 on evidence from documents and the site visit.
| Criterion | Weight | Evidence to request | Maps to |
|---|---|---|---|
| Assurance scope | 15% | Certificates with site and scope, SOC 2 Type II with period and exceptions, bridge letter | SA-9, CA-2; CSF GV.SC-06 |
| Physical access control | 20% | Zoning plan, entry technology, anti-tailgating, visitor and escort procedure, access list process | PE-2, PE-3 |
| Monitoring and evidence | 15% | CCTV coverage and retention, access log retention, request process and turnaround, security staffing | PE-6; CSF DE.CM-02 |
| Personnel and remote hands | 10% | Screening of staff and contractors, remote hands authorisation, work evidence | PS-3 |
| Resilience | 15% | Independent Tier or rating certificate, maintenance and test records, incident history | PE-11, PE-13, PE-14, PE-15; CSF PR.IR-02 |
| Facility systems and connectivity | 10% | Network segregation of building and DCIM systems, cross-connect process, meet-me room controls | SC-7 |
| Contract, incidents and exit | 15% | Incident notification terms, audit and site visit rights, media handling, exit and decommissioning support | SA-4, SR-5; CSF GV.SC-05, GV.SC-07 |
Where identity fits
A colocation contract creates several identity systems you depend on but do not run: the provider's access card and biometric enrolment, its list of your authorised people, the portal used to raise remote hands tickets and visitor passes, and the accounts of its staff on building management and DCIM systems. Require SSO and MFA for the customer portal, because a stolen portal account can add an attacker to your access list or open a remote hands job on your rack. Ask how the provider removes leavers from its own access systems and how quickly it applies your removals. Inside your rack, the most valuable targets are management interfaces: BMC and IPMI ports, KVM-over-IP devices, serial console servers and out-of-band routers, all with machine credentials that are rarely rotated. See the KVM-over-IP Security Guide, the Out-of-Band Management Network Design Guide and the UPS, Rack PDU and DCIM Security Guide.
Decision guidance by organisation size
- Small footprints: a few racks in a shared hall is normal. Compensate with locking racks or a small cage, tamper-evident seals, full disk encryption, alerting on chassis intrusion where hardware supports it, and strict remote hands rules.
- Large or regulated estates: expect a private cage or suite with your own access control, CCTV covering your space with footage available on request, audit rights, and independently certified resilience at both primary and secondary sites.
- Managed data centre services: provider staff will hold administrative credentials to your systems, so add the logical controls you would require of a managed service provider: privileged access management, session recording and named engineers.
- Hybrid with cloud: colocation is often chosen for private connectivity to cloud regions. Assess the cloud side with the Security Requirements for Selecting a Cloud Provider.
Questions to ask vendors
- Is this specific site named in your ISO/IEC 27001 certificate and SOC 2 Type II report, and do they cover physical security, remote hands and cross-connect services?
- How many access control layers are between the street and our rack, and which of them require two factors?
- How do you prevent tailgating into data halls, and how are tailgating events detected and recorded?
- Who maintains our access list, how quickly do you apply a removal, and can we see an export of current entries at any time?
- How long do you keep CCTV footage and access logs, does CCTV cover the aisle and door of our space, and how quickly can we obtain footage after an incident?
- What checks apply to your staff and contractors, and are they repeated?
- What must happen before remote hands staff touch our equipment, and can we receive photos or video of the work?
- Is your Tier or rating certificate for the design or for the constructed and operating facility, and when was it issued?
- How are building management, DCIM, CCTV and access control systems separated from customer networks, and who can administer them remotely?
- How quickly will you notify us of a security or availability incident at the site, and is that contractual?
- Can we destroy media on site under our own supervision, and what chain of custody records do you keep?
- What audit and site visit rights do we have, and what notice do you need?
Red flags
- Certificates or reports that cover a head office or a different site, or that exclude physical security.
- Single-factor card access to data halls, or shared cages with no per-customer rack locking.
- CCTV retention measured in days, or no commitment to provide footage of your space.
- Remote hands work started on a phone call without a ticket from an authorised contact.
- A resilience rating that is design-only, out of date, or self-declared.
- Building management or DCIM systems reachable from the internet or from customer networks.
- No on-site media destruction option and no chain of custody for removed equipment.
Proof of concept
For a facility, the proof of concept is a structured site visit plus a document review. Bring someone from facilities and someone from security, and keep notes against the capability table.
- Before the visit, review certificates, SOC 2 report scope and exceptions, and the resilience certificate, and list the gaps to test on site.
- Walk the route from the site perimeter to the proposed space, counting access layers, noting which require two factors, and observing anti-tailgating controls.
- Ask to see where CCTV covers the proposed space, how footage is retrieved, and a sample of an access log extract for a test visit.
- Raise a test remote hands ticket through the portal and confirm it requires an authorised contact and records the technician's identity.
- Add and remove a test person from the access list and time how quickly the removal takes effect at the door.
- Inspect meet-me rooms and cross-connect paths, and ask how cross-connect requests are authorised.
- Review generator, UPS and fire suppression test records for the last year, and recent incident reports.
- Confirm media destruction and exit arrangements in writing, and agree go-live metrics: time to apply an access removal, footage request turnaround, number of unauthorised remote hands jobs, and audit findings closed.
Primary sources used here: CENELEC: EN 50600-2-5:2021 Security systems, Uptime Institute: Tier Classification System, TIA: ANSI/TIA-942 Standard, EUR-Lex: Directive (EU) 2022/2555 (NIS2), NIST: SP 800-53 Rev. 5, NIST: Cybersecurity Framework 2.0 and ISO: ISO/IEC 27001:2022.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our NHI and AI products directory or contact us.
Related NHI Mgmt Group resources: Data Centre Security Guide · Physical Security Guide for Security Teams · Data Centre Migration and Relocation Security Guide · Business Continuity and Disaster Recovery Guide · Security Requirements for Selecting a Cloud Provider