Who owns which layer
In colocation, the provider controls the site, the building and the halls. You control your cage and cabinets, the list of people allowed in, and everything you ship in or out. Both sides assume the other is checking the join. Start by writing down, layer by layer, whose control it is.
Perimeter and building
- Vehicle approach, fencing and gates, and what happens at the gate after hours.
- Doors that are alarmed and monitored, versus doors that are merely locked.
- Shipping and receiving: who can bring a pallet in, and who checks what is on it.
Lobby and mantrap
- How identity is checked on arrival, and against what list.
- Mantraps and turnstiles: whether they actually prevent two people passing on one credential, including at shift change.
- Anti-passback: whether it is enforced or only logged.
Hall, cage and cabinet
- Which credential technology the hall and cage readers accept. See MIFARE Classic vs DESFire vs Seos.
- Whether your cage can be reached through a neighbour’s, over the top or under the floor.
- Cabinet locks: shared keys, combination locks never changed, or electronic locks with an audit trail.
- Remote hands: how a request is verified before a technician opens your cabinet.
People
- Your authorized-access list at the provider: who is on it, and who removes leavers. See why a terminated employee’s badge still works.
- Escort and contractor records, and whether they still mean anything weeks later.
Chain of custody
- How a failed or retired drive leaves the rack, who holds it, and where it is stored.
- Sanitization or destruction method, for example following NIST SP 800-88.
- Whether destruction is witnessed or evidenced by serial number, not just certified in bulk.
Standards this maps to
TIA-942 covers data center design, including security, alongside power and cooling. ISO/IEC 27001 Annex A.7 and SOC 2 CC6.4 are the controls your customers’ auditors will ask about.
How we assess it
Cage and cabinet access and chain of custody are two of the six areas of our credential and access control assessment. We assess day and night, and findings name the technology to move to, with a price range on each.
Last reviewed October 13, 2026.