Data Centre and Colocation Assessment Template (ISO/IEC 27001)

Facility profile, shared responsibility, evidence pack, weighted checklist (access, power, cooling, fire, contract, audit rights, climate), scoring, decision

SMKI & ISO/IEC 27001LengkapISO/IEC 27001:2022 + Amd 1:2024 A.5.19 to A.5.22, A.5.30, A.7 (cited only); ISO/IEC 27002:2022data centre colocation assessmentDiperbarui 1 Nov 2026

Buka di editorUnduh .md

Cara menggunakan: Use it before a colocation contract, annually per facility and after major incidents; adapt it as a self-assessment for your own data centre. Fill the facility profile and agree weights and knock-out items first. The main pitfall is accepting a provider certificate whose scope does not name this facility.

Pratinjau

Data Centre and Colocation Assessment: [Facility name and provider]

Assessment checklist and scoring record for a data centre that the organization runs itself or rents space in (colocation suite, cage or racks). It covers site, physical access, power, cooling, fire, monitoring, connectivity, remote hands, contract and audit rights, provider certifications and climate resilience. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A physical controls A.7.1 to A.7.14, supplier controls A.5.19 to A.5.22 and ICT readiness A.5.30, with guidance in ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: have contract terms reviewed by your legal adviser.

Document control

Field	Value
Document ID	DOC-ISMS-079
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@it-infrastructure-lead]
Approvers/reviewers	[@isms-manager], [@ciso], [@procurement-lead], [@legal-counsel]
Last updated	YYYY-MM-DD
Classification	[Confidential] (contains site security details)
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024, A.5.19 to A.5.22, A.5.30, A.7.1 to A.7.14; ISO/IEC 27002:2022
Next scheduled review	YYYY-MM-DD (annual, or after an incident or contract change)
Facility	[Name, address, hall and cage or rack IDs]
Provider and supplier ID	[Provider name], [SUP-NNN in DOC-ISMS-066]
Assessment type	[Pre-contract / Annual / Post-incident / Self-assessment of own facility]
Assessment date and team	YYYY-MM-DD, [@assessor-1], [@assessor-2]

Approvals

Role	Name	Decision	Date
Lead assessor	[@it-infrastructure-lead]	[Prepared]	YYYY-MM-DD
ISMS manager	[@isms-manager]	[Reviewed]	YYYY-MM-DD
Risk owner for hosted services	[@cto]	[Accepted / Accepted with action plan / Rejected]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2027-03-10	[@it-infrastructure-lead]	Annual assessment of colocation suite, score 78.5 of 100
1.1 (Example)	2027-06-15	[@it-infrastructure-lead]	Audit rights clause signed; section I re-scored

Purpose and scope
Facility profile and shared responsibility
Method, scoring and knock-out criteria
Evidence requested before the visit
Assessment checklist
Scoring summary and decision
Findings and action plan
Size tiers
Records and evidence
References

1. Purpose and scope

This assessment determines whether [facility] provides physical, environmental and operational protection adequate for the information and services hosted there, and whether the contract gives the organization the rights it needs to keep that assurance over time.

Item	Value
Hosted services	[e.g. production database cluster, backup storage, OT historian]
Highest classification of hosted information	[Confidential / Restricted]
Role of the facility	[Primary / Recovery / Both]
Recovery time objective of hosted services	[hours, from the BIA DOC-ISMS-120]
Risks addressed	[RISK-NNN in DOC-ISMS-016]
Out of scope	[e.g. provider's other halls, provider's office building]

2. Facility profile and shared responsibility

Area	Provider	Organization	Evidence of the split
Site perimeter, reception, guards	[Yes]	[No]	[Service description, clause n]
Hall and cage access control	[Badge and biometric system]	[Cage lock, own access list]	[Access procedure]
Power to the rack (UPS, generator)	[Yes, to the power distribution unit]	[Rack power strips, load within contract]	[SLA]
Cooling and environment	[Yes]	[Blanking panels, airflow in own racks]	[SLA]
Fire detection and suppression	[Yes]	[No combustible storage in cage]	[House rules]
CCTV and alarms	[Hall and corridors]	[Optional camera inside cage]	[Service description]
Network connectivity	[Meet-me room, cross connects]	[Own routers, carriers]	[Order forms]
Remote hands	[Yes, on ticket]	[Approves and specifies tasks]	[Remote hands terms]
Media destruction	[Optional service]	[Owns the decision and the record DOC-ISMS-057]	[Order]

3. Method, scoring and knock-out criteria

3.1 Method

The assessment runs in the same order every cycle, so results from different years and facilities can be compared.

3.2 Item scale

Score	Meaning
0	Not in place, or no evidence offered
1	Partly in place; significant gaps
2	In place with minor gaps or partial evidence
3	Fully in place with current, verifiable evidence
N/A	Does not apply to this facility (excluded from the average, reason recorded)

3.3 Section weights and bands

Section score = average of its item scores. Weighted points = weight x section score / 3. Total = sum of weighted points (maximum 100).

Band	Total	Decision rule
Acceptable	80 or more, no knock-out at 0	Risk owner accepts; next review in 12 months
Acceptable with action plan	65 to 79.9, no knock-out at 0	Risk owner accepts with dated actions; re-check within [6 months]
Not acceptable	Below 65, or any knock-out at 0	Do not place new services; escalate per DOC-ISMS-015

3.4 Knock-out items

Items marked K in section 5. Example knock-outs: no individual access logging to the hall, no generator or equivalent for the stated SLA, no fire detection in the hall, no right to receive independent assurance reports, provider unable to show insurance or financial stability information.

4. Evidence requested before the visit

Evidence	What to check	Received
ISO/IEC 27001 certificate and Statement of Applicability summary	Facility named in the certificate scope; valid dates; certification body accredited under the Global ACI MRA (formerly IAF MLA)	[Yes / No]
Independent assurance report (for example a SOC 2 Type 2 or SOC 1 report)	Facility in scope; period covered; exceptions and complementary user entity controls	[Yes / No]
Business continuity certification or plan summary (for example ISO 22301)	Facility in scope; last exercise date	[Yes / No]
Data centre design or operation classification (for example ISO/IEC 22237 series or ANSI/TIA-942 based)	Claimed level matches the design you are buying; independent or self-declared	[Yes / No]
Payment card attestation where card data is hosted	Physical requirements in scope	[Yes / No / N/A]
Maintenance and test records summary (UPS, generator, cooling, fire)	Dates within the last 12 months	[Yes / No]
Incident history for the last 24 months	Power, cooling and security incidents with root cause	[Yes / No]
Insurance certificate and financial stability information	Cover type and amount; ownership changes	[Yes / No]
Environmental and climate risk statement	Flood, heat, water supply, grid risk	[Yes / No]

5. Assessment checklist

A. Site and location (weight 8)

ID	Check	Evidence expected	Score
DCA-A-01	Site risk assessment covers flood, seismic, industrial neighbours, flight paths and transport access	Provider risk summary, maps	[0-3]
DCA-A-02	Building is discreet: no external signage that reveals the data centre purpose	Observation	[0-3]
DCA-A-03	Distance to the other site (primary or recovery) is enough that one regional event does not hit both	Map, BIA	[0-3]
DCA-A-04	Staff can reach the site during disruption (transport, parking, out-of-hours access)	Access procedure	[0-3]

B. Perimeter and building access (weight 14)

ID	Check	Evidence expected	K	Score
DCA-B-01	Layered perimeter: fence or building shell, reception, hall, cage	Observation, floor plan		[0-3]
DCA-B-02	Every entry to the hall is logged to an individual (badge plus PIN or biometric)	Access system demo, log sample	K	[0-3]
DCA-B-03	Visitors are identified with a government ID, pre-registered by an authorised customer contact and escorted	Visitor procedure, log sample		[0-3]
DCA-B-04	Anti-tailgating at hall entry (mantrap, turnstile or guard)	Observation		[0-3]
DCA-B-05	Customer access list changes are processed only from authorised contacts and confirmed in writing	Ticket sample		[0-3]
DCA-B-06	Organization can obtain its own access log for its cage on request within [5 working days]	Contract, sample		[0-3]
DCA-B-07	Loading bay is separated from halls; deliveries are inspected and logged	Observation		[0-3]
DCA-B-08	Cage or rack locks are individual; master keys controlled by provider key register	Key procedure		[0-3]

C. Power (weight 14)

ID	Check	Evidence expected	K	Score
DCA-C-01	Redundant utility feeds or documented single-feed risk with mitigation	Single-line diagram		[0-3]
DCA-C-02	UPS with redundancy (for example N+1) and battery autonomy matching the generator start time	UPS design summary		[0-3]
DCA-C-03	Generator capacity for full hall load with on-site fuel for [24 to 48 hours] (Example) and refuel contracts	Fuel contract, test log	K	[0-3]
DCA-C-04	Generator tested on load at the stated interval; results recorded	Test records last 12 months		[0-3]
DCA-C-05	Dual power feeds (A and B) delivered to each rack from separate distribution paths	Observation, order form		[0-3]
DCA-C-06	Power usage per rack monitored and reported to the customer	Portal demo		[0-3]

D. Cooling and environment (weight 10)

ID	Check	Evidence expected	Score
DCA-D-01	Cooling capacity with redundancy for the hall	Design summary	[0-3]
DCA-D-02	Temperature and humidity monitored at rack inlet with alert thresholds agreed in the SLA	SLA, portal	[0-3]
DCA-D-03	Leak detection under raised floors and around cooling units	Observation, test record	[0-3]
DCA-D-04	Hot and cold aisle containment or equivalent airflow management	Observation	[0-3]
DCA-D-05	Plan for extreme heat days (capacity margin, water supply for cooling where used)	Provider statement	[0-3]

E. Fire detection and suppression (weight 10)

ID	Check	Evidence expected	K	Score
DCA-E-01	Early warning smoke detection in the hall	Observation, maintenance record	K	[0-3]
DCA-E-02	Suppression system suitable for electrical equipment, zoned to limit impact	Design summary		[0-3]
DCA-E-03	Fire systems inspected and tested at the interval set by local rules	Inspection certificate		[0-3]
DCA-E-04	No combustible storage in halls; house rules enforced	Observation		[0-3]
DCA-E-05	Customer notified of fire alarms and suppression events affecting its equipment	Notification procedure		[0-3]

F. Monitoring and operations (weight 8)

ID	Check	Evidence expected	Score
DCA-F-01	Operations centre staffed around the clock or with defined on-call	Staffing summary	[0-3]
DCA-F-02	CCTV covers perimeter, entrances, halls and corridors; retention at least [30 days] (Example)	Observation, retention setting	[0-3]
DCA-F-03	Security incidents and physical alarms are reported to customers within an agreed time	Contract, incident sample	[0-3]
DCA-F-04	Provider staff are screened and trained; contractors escorted	HR summary, training record	[0-3]

G. Connectivity (weight 6)

ID	Check	Evidence expected	Score
DCA-G-01	Several carriers available; diverse building entry points	Carrier list, plan	[0-3]
DCA-G-02	Meet-me room access controlled and logged	Observation	[0-3]
DCA-G-03	Cross-connect orders and changes documented and confirmed to the customer	Order sample	[0-3]

H. Remote hands and change (weight 6)

ID	Check	Evidence expected	Score
DCA-H-01	Remote hands work only on tickets from authorised contacts, with identity check for phone requests	Procedure	[0-3]
DCA-H-02	Remote hands staff follow customer instructions for media: no removal of drives without written approval	Procedure, contract	[0-3]
DCA-H-03	Provider maintenance that may affect customers is announced in advance with a change window	Change notices sample	[0-3]

I. Contract, audit rights and exit (weight 12)

ID	Check	Evidence expected	K	Score
DCA-I-01	Right to receive independent assurance reports and certificates each year	Contract clause	K	[0-3]
DCA-I-02	Right to audit or visit, including after a security incident	Contract clause		[0-3]
DCA-I-03	SLA for power and cooling availability with service credits and reporting	SLA		[0-3]
DCA-I-04	Security incident notification duty with a time limit	Contract clause		[0-3]
DCA-I-05	Subcontracting of security or operations needs notice to the customer	Contract clause		[0-3]
DCA-I-06	Exit: notice period, support to move equipment, return of access cards and keys	Contract clause		[0-3]

J. Certifications and assurance (weight 8)

ID	Check	Evidence expected	Score
DCA-J-01	ISO/IEC 27001 certificate names this facility and is valid	Certificate, register check	[0-3]
DCA-J-02	Independent assurance report covers this facility; exceptions reviewed	Report	[0-3]
DCA-J-03	Complementary customer controls listed in reports are mapped to the organization's own controls	Mapping note	[0-3]
DCA-J-04	Design or operation classification claims are supported by evidence	Certificate or statement	[0-3]

K. Climate and sustainability resilience (weight 4)

ID	Check	Evidence expected	K	Score	Notes
DCA-K-01	Provider has assessed climate-related hazards for the site (flood, heat, water, grid)	Statement, risk summary		[0-3]
DCA-K-02	Energy efficiency and water use are reported, where relevant to customer requirements from clause 4.2	Report		[0-3]

6. Scoring summary and decision

6.1 Worked example: Quillmere Health Systems colocation suite

Section	Weight	Section score (0 to 3)	Weighted points
A. Site and location (Example)	8	2.50	6.67
B. Perimeter and building access (Example)	14	2.75	12.83
C. Power (Example)	14	2.50	11.67
D. Cooling and environment (Example)	10	2.40	8.00
E. Fire detection and suppression (Example)	10	2.00	6.67
F. Monitoring and operations (Example)	8	2.50	6.67
G. Connectivity (Example)	6	3.00	6.00
H. Remote hands and change (Example)	6	2.00	4.00
I. Contract, audit rights and exit (Example)	12	1.50	6.00
J. Certifications and assurance (Example)	8	2.75	7.33
K. Climate and sustainability resilience (Example)	4	2.00	2.67
Total (Example)	100		78.5

Section scores are averages of whole-number item scores (B: 22 of 24 points over 8 items; C: 15 of 18 over 6 items). Weighted points are rounded to two decimals; the total is computed from unrounded values. Knock-out check: no K item scored 0. The lowest K item was DCA-I-01 (score 1: reports available only under a separate NDA request each year, no contractual right).

Decision (Example): 78.5 falls in the band "Acceptable with action plan". The risk owner accepted with actions ACT-001 to ACT-003, a re-check of section I within 6 months, and risk RISK-044 kept at Medium in DOC-ISMS-016.

6.2 Decision record

Field	Value
Total score and band	[nn.n, band]
Knock-out items at 0	[None / list]
Decision	[Accepted / Accepted with action plan / Not acceptable]
Conditions	[list]
Risk register update	[RISK-NNN, new score]
Decided by and date	[@risk-owner], YYYY-MM-DD
Next assessment due	YYYY-MM-DD

7. Findings and action plan

Action ID	Item	Finding	Action	Owner	Due	Status
ACT-001 (Example)	DCA-I-01	No contractual right to annual assurance reports	Add assurance report clause at renewal (amendment signed)	[@procurement-lead]	2027-06-30	Closed 2027-06-15
ACT-002 (Example)	DCA-E-03	Fire suppression inspection certificate 14 months old	Obtain current certificate from provider	[@it-infrastructure-lead]	2027-04-30	Open
ACT-003 (Example)	DCA-H-02	Remote hands terms silent on drive removal	Written instruction filed with provider; confirm in next contract amendment	[@it-ops-lead]	2027-05-31	Open
[ACT-NNN]	[item]	[finding]	[action]	[@owner]	YYYY-MM-DD	[Open / Closed]

8. Size tiers

Topic	Small: Quillmere Analytics Ltd	Medium: Quillmere Health Systems	Large: Quillmere Group
Facilities	None of its own; production on one public cloud provider in two regions	One colocation suite (primary production for the managed service)	One own group data centre plus any colocation used by country units
Use of this template	Not used for the cloud regions: assess the provider through reports under `compliance/supplier-security-assessment`. Use only if a colocation rack is added later	Pre-contract and annual assessment with a site visit by the infrastructure lead and a security team member	Annual self-assessment of the own data centre (sections I and J adapted to internal service agreements) and annual assessment of each colocation site
Assessors	Not applicable	2 people, one day on site	Security office plus site facilities; internal audit samples one facility per year
Reporting	Not applicable	Steering committee and management review	Group steering committee, site results consolidated

9. Records and evidence

Record	Owner	Location	Retention
Completed assessment with scores and decision	IT infrastructure lead	[GRC tool or document system]	Contract plus [3 years]
Evidence pack (certificates, reports, test records)	IT infrastructure lead	[Restricted folder]	Contract plus [3 years]
Site visit notes and photos (where allowed)	Lead assessor	[Restricted folder]	Contract plus [3 years]
Action plan and closure evidence	ISMS manager	Section 7 and DOC-ISMS-088	Until closed plus [3 years]
Access list reconciliations for the cage	IT operations	[Ticket system]	[3 years]

Map these records under A.5.22 and A.7 in the control evidence matrix (DOC-ISMS-033, isms/control-evidence-matrix) and link the supplier entry in DOC-ISMS-066.

10. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	2022, Amd 1 2024-02-23	Annex A A.5.19 to A.5.22, A.5.30, A.7. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html
ISO/IEC 27002:2022	2022	Control guidance. https://www.iso.org/standard/75652.html
ISO/IEC 27036-1:2021	2021	Supplier relationships overview. https://www.iso.org/standard/82905.html
ISO/IEC 27031:2025	2025	ICT readiness for business continuity. https://www.iso.org/standard/80975.html
ISO 22301:2019 + Amd 1:2024	2019, Amd 2024	Business continuity management. https://www.iso.org/standard/75106.html
ISO/IEC 22237 series (data centre facilities and infrastructure)	Part 1: 2021; check the current edition of each part	Example of a design and operation classification

Related templates: isms/physical-security-policy, isms/supplier-register, isms/supplier-security-agreement-27036, compliance/supplier-security-assessment, compliance/business-impact-analysis, isms/ict-readiness-business-continuity-plan, ops/disaster-recovery-plan, isms/equipment-disposal-reuse-record, isms/cloud-services-security-policy, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.5.19 to A.5.22, A.5.30 and A.7.1 to A.7.14, with guidance from ISO/IEC 27002:2022. The checklist, weights, scoring model and examples are original wording; no ISO/IEC text is reproduced, and the named certifications and design standards are examples, not recommendations of any provider. You need the official standards to apply the controls: https://www.iso.org/standard/82875.html. Check the current edition of each reference before use. This is a documentation format, not legal advice. Quillmere names are fictional. Template licence: MIT.

Templat terkait

SMKI & ISO/IEC 27001