A colocation data center is a facility where you place your own servers and network gear while the provider supplies the building, power, cooling and physical security. You still run and secure everything inside your racks. Before signing, check physical access, power, fire protection, environment and monitoring.
Who is responsible for what?
The provider owns the building and the physical layer around your cage or rack. You own the hardware, the operating system, the network configuration, the data and the people who touch them. That line moves in different directions depending on the contract, so write it down. If something sits in the gap, such as remote hands who can power-cycle your machines, decide who is accountable.
What does NIST suggest checking?
NIST SP 800-53 has a family of physical and environmental protection controls that read like a checklist for a site visit.
- Access lists (PE-2). A maintained and approved list of people authorized to enter, with credentials issued, reviewed on a schedule, and people removed when access is no longer needed. Ask how often the provider reviews and how fast it removes a departing technician.
- Access control (PE-3). Verify authorization before entry, control entry and exit, keep physical access logs, escort visitors, and secure keys and combinations. Ask what logs exist and whether you get them.
- Monitoring (PE-6). Monitor physical access to detect and respond to incidents, review the logs, and coordinate with incident response. Ask how the provider would tell you about an incident.
- Power equipment and cabling (PE-9) and emergency power (PE-11). Protection for power gear and cabling, and an uninterruptible power supply to carry load when the primary source fails. Ask what runs on backup, for how long, and when it was last tested.
- Fire protection (PE-13). Detection and suppression supported by an independent energy source.
- Environmental controls (PE-14). Temperature and humidity maintained and monitored.
What does a good answer sound like?
Constructed example. You ask a provider: "If a technician from another customer walks into the wrong aisle, what stops them?" A good answer describes cage or cabinet locks, escorted access for anyone not on the list, door and camera logs, and a process for reviewing them. A weak answer is "we trust our staff."
Ask the same for deliveries and for decommissioned drives. Gear leaving a rack should have a documented sanitization or destruction path.
What do you still own?
Everything you can configure. Encrypt disks so a stolen drive is only metal. Keep remote management interfaces off the public internet. Keep an inventory of what is racked where, and compare it to reality at least once a year. NIST's system component inventory control (CM-8) calls for an inventory that accurately reflects the system and includes all components. Colocated hardware is easy to forget because nobody sees it daily.
Tie it to risk assessment too. NIST RA-3 asks you to identify threats and vulnerabilities and determine likelihood and magnitude of harm. A single-site colocation deployment has a location risk that no rack lock addresses. Ask whether you need a second site, and test failover.
How to check or apply this
- Request the provider's independent audit reports and read the scope, not just the cover page.
- Walk the site, or ask for a recorded walkthrough, and compare it to the control list above.
- Get written answers on access lists, visitor handling, logging, power runtime and fire protection.
- Define remote hands rules: who can request them, how identity is checked, what they may touch.
- Encrypt storage and secure management networks on your side.
- Keep a rack inventory and reconcile it every year.
- Write exit terms: how to retrieve or destroy gear and data if you leave.
Quick check
Does colocation mean the provider handles my security?
Only the physical layer. You remain responsible for hardware configuration, software, data and your own staff's access. The contract should state the boundary.
Why ask about remote hands?
Provider staff can touch your equipment on request. If identity checks for those requests are weak, an attacker may be able to impersonate you and get physical access by phone.
Sources
Last reviewed: 18 October 2026.
