Colocation cage and cabinet access audit
In a colocation facility your equipment sits behind a door you do not control. The operator issues the badges, runs the access list, employs the remote hands and holds a key to your rack. We audit the whole chain between the front door and your cabinet, and tell you who can actually reach your equipment today.
Who it is for
- Tenants with equipment in one or more colocation facilities who have never checked the operator’s access list against their own.
- GPU cloud and AI companies that moved into colocation quickly and now hold very valuable hardware in shared space.
- Colocation operators who want an independent view of tenant separation before a customer audit finds it.
- Teams that need evidence for SOC 2 CC6.4 or ISO 27001 A.7 covering hosted equipment.
What we assess
- The operator’s access list for your cage, compared with your own list of who should have access.
- Credentials: the card and reader technology used to reach your space, and how easily it clones.
- Cage construction and separation: mesh, ceiling and floor gaps, and what the neighbouring tenant can reach.
- Rack and cabinet locks: key, combination or electronic, who holds the master key, and whether keys are shared between customers.
- Remote hands and operator staff: what they can open, how requests are verified, and what is logged.
- Deprovisioning: whether a departed employee or contractor of yours is still on the operator’s list.
- Media and hardware leaving the cage: RMA shipments, drive swaps and destruction.
What you receive
- A reconciled access list: every person who can reach your cage, and whether they should.
- Findings ranked, each with a price range and the change to ask the operator or your own team for.
- Findings mapped to SOC 2 CC6.4 and ISO 27001 A.7 where they apply.
- A re-test of Critical and High findings within 90 days of the report.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one day on site per facility plus a review of access records, with the report two weeks later. One site starts from $9,500.
Common questions
Will the colocation operator let you in?
Tenants normally have the right to escort a consultant into their own space. Anything that touches shared areas or the operator’s systems is agreed with the operator in advance, and we work from the operator’s own assurance reports where testing is not allowed.
We have cages in several facilities. Do you need to visit all of them?
Not always. Access lists and remote hands procedures can be reviewed for every site; we visit the sites that hold the most valuable equipment or where the records raise questions.
Is this a SOC 2 audit?
No. We test the physical controls and map each finding to the control it affects. We are not your auditor and issue no attestation.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Colocation cage access audit
We reply within one business day.
Nothing you send is shared outside Calibre.