# Data Centre and Colocation Assessment: [Facility name and provider]

> Assessment checklist and scoring record for a data centre that the
> organization runs itself or rents space in (colocation suite, cage or
> racks). It covers site, physical access, power, cooling, fire,
> monitoring, connectivity, remote hands, contract and audit rights,
> provider certifications and climate resilience. It supports ISO/IEC
> 27001:2022 + Amd 1:2024 Annex A physical controls A.7.1 to A.7.14,
> supplier controls A.5.19 to A.5.22 and ICT readiness A.5.30, with
> guidance in ISO/IEC 27002:2022. Replace every `[bracketed]` value and
> every row marked *Example*. This is a documentation format, not legal
> advice: have contract terms reviewed by your legal adviser.

<!--
Guidance: How to use this template
- Use it before signing a colocation contract, at least annually for
  each facility in scope, and after a major incident or provider
  change. For your own data centre, use it as a self-assessment with
  sections I and J adapted to internal agreements.
- Fill section 2 (facility profile) and section 3 (scoring rules and
  knock-out criteria) first. Agree the knock-outs before the site
  visit, so that a pleasant tour does not change the bar.
- The main pitfall is accepting a provider certificate without reading
  its scope. A certificate that covers the provider's head office but
  not this facility is no evidence for this facility.
- Public cloud data centres usually cannot be visited. Assess cloud
  providers through their certificates and independent reports under
  `isms/cloud-services-security-policy` and
  `compliance/supplier-security-assessment`, not with a site visit.
- Related templates: `isms/physical-security-policy`,
  `isms/supplier-register`, `isms/supplier-security-agreement-27036`,
  `compliance/business-impact-analysis`,
  `isms/ict-readiness-business-continuity-plan`,
  `ops/disaster-recovery-plan`, `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: One completed assessment per facility per cycle. Keep earlier assessments: trends across years are evidence of supplier monitoring (A.5.22). -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-079 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@it-infrastructure-lead] |
| Approvers/reviewers | [@isms-manager], [@ciso], [@procurement-lead], [@legal-counsel] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] (contains site security details) |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, A.5.19 to A.5.22, A.5.30, A.7.1 to A.7.14; ISO/IEC 27002:2022 |
| Next scheduled review | YYYY-MM-DD (annual, or after an incident or contract change) |
| Facility | [Name, address, hall and cage or rack IDs] |
| Provider and supplier ID | [Provider name], [SUP-NNN in DOC-ISMS-066] |
| Assessment type | [Pre-contract / Annual / Post-incident / Self-assessment of own facility] |
| Assessment date and team | YYYY-MM-DD, [@assessor-1], [@assessor-2] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Lead assessor | [@it-infrastructure-lead] | [Prepared] | YYYY-MM-DD |
| ISMS manager | [@isms-manager] | [Reviewed] | YYYY-MM-DD |
| Risk owner for hosted services | [@cto] | [Accepted / Accepted with action plan / Rejected] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | 2027-03-10 | [@it-infrastructure-lead] | Annual assessment of colocation suite, score 78.5 of 100 |
| 1.1 *(Example)* | 2027-06-15 | [@it-infrastructure-lead] | Audit rights clause signed; section I re-scored |

## Contents

<!-- Guidance: Sections 1 to 4 frame the assessment. Section 5 is the checklist walked on site. Sections 6 to 9 turn results into decisions and evidence. -->

1. Purpose and scope
2. Facility profile and shared responsibility
3. Method, scoring and knock-out criteria
4. Evidence requested before the visit
5. Assessment checklist
6. Scoring summary and decision
7. Findings and action plan
8. Size tiers
9. Records and evidence
10. References

## 1. Purpose and scope

<!-- Guidance: State why this assessment is done and which services depend on the facility. Questions to answer: what is the recovery time objective of the hosted services? Is this the primary or the recovery site? Pitfall: assessing a recovery site less strictly than the primary one, when a disaster will make it the only site. -->

This assessment determines whether [facility] provides physical,
environmental and operational protection adequate for the information
and services hosted there, and whether the contract gives the
organization the rights it needs to keep that assurance over time.

| Item | Value |
|---|---|
| Hosted services | [e.g. production database cluster, backup storage, OT historian] |
| Highest classification of hosted information | [Confidential / Restricted] |
| Role of the facility | [Primary / Recovery / Both] |
| Recovery time objective of hosted services | [hours, from the BIA DOC-ISMS-120] |
| Risks addressed | [RISK-NNN in DOC-ISMS-016] |
| Out of scope | [e.g. provider's other halls, provider's office building] |

## 2. Facility profile and shared responsibility

<!-- Guidance: Record who does what. In colocation the provider runs the building and the organization runs its cage. Auditor check: the split here matches the contract and the SoA justification for A.7 controls. -->

| Area | Provider | Organization | Evidence of the split |
|---|---|---|---|
| Site perimeter, reception, guards | [Yes] | [No] | [Service description, clause n] |
| Hall and cage access control | [Badge and biometric system] | [Cage lock, own access list] | [Access procedure] |
| Power to the rack (UPS, generator) | [Yes, to the power distribution unit] | [Rack power strips, load within contract] | [SLA] |
| Cooling and environment | [Yes] | [Blanking panels, airflow in own racks] | [SLA] |
| Fire detection and suppression | [Yes] | [No combustible storage in cage] | [House rules] |
| CCTV and alarms | [Hall and corridors] | [Optional camera inside cage] | [Service description] |
| Network connectivity | [Meet-me room, cross connects] | [Own routers, carriers] | [Order forms] |
| Remote hands | [Yes, on ticket] | [Approves and specifies tasks] | [Remote hands terms] |
| Media destruction | [Optional service] | [Owns the decision and the record DOC-ISMS-057] | [Order] |

## 3. Method, scoring and knock-out criteria

<!-- Guidance: Use a simple, repeatable scale. Weights reflect what matters for your services; agree them with the risk owner before scoring. Pitfall: changing weights after scoring to reach a pass. -->

### 3.1 Method

The assessment runs in the same order every cycle, so results from
different years and facilities can be compared.

```mermaid
flowchart LR
  A["Plan: scope, weights, knock-outs"] --> B["Request evidence pack"]
  B --> C["Desk review of reports and certificates"]
  C --> D["Site visit or virtual walk-through"]
  D --> E["Score each item 0 to 3"]
  E --> F{"Any knock-out item scored 0?"}
  F -- "Yes" --> G["Not acceptable until fixed"]
  F -- "No" --> H["Weighted score and band"]
  H --> I["Findings, actions, risk owner decision"]
  G --> I
```

### 3.2 Item scale

| Score | Meaning |
|---|---|
| 0 | Not in place, or no evidence offered |
| 1 | Partly in place; significant gaps |
| 2 | In place with minor gaps or partial evidence |
| 3 | Fully in place with current, verifiable evidence |
| N/A | Does not apply to this facility (excluded from the average, reason recorded) |

### 3.3 Section weights and bands

Section score = average of its item scores. Weighted points = weight x
section score / 3. Total = sum of weighted points (maximum 100).

| Band | Total | Decision rule |
|---|---|---|
| Acceptable | 80 or more, no knock-out at 0 | Risk owner accepts; next review in 12 months |
| Acceptable with action plan | 65 to 79.9, no knock-out at 0 | Risk owner accepts with dated actions; re-check within [6 months] |
| Not acceptable | Below 65, or any knock-out at 0 | Do not place new services; escalate per DOC-ISMS-015 |

### 3.4 Knock-out items

Items marked **K** in section 5. Example knock-outs: no individual
access logging to the hall, no generator or equivalent for the stated
SLA, no fire detection in the hall, no right to receive independent
assurance reports, provider unable to show insurance or financial
stability information.

## 4. Evidence requested before the visit

<!-- Guidance: Ask for evidence in writing at least two weeks ahead. Check each certificate against the issuing body's public register and the accreditation: the certification body should be accredited by an accreditation body that is a signatory of the Global ACI MRA (formerly IAF MLA); the IAF CertSearch database can be used to look up accredited certificates (check that it still operates). Do not treat a certificate as a recommendation of the provider. -->

| Evidence | What to check | Received |
|---|---|---|
| ISO/IEC 27001 certificate and Statement of Applicability summary | Facility named in the certificate scope; valid dates; certification body accredited under the Global ACI MRA (formerly IAF MLA) | [Yes / No] |
| Independent assurance report (for example a SOC 2 Type 2 or SOC 1 report) | Facility in scope; period covered; exceptions and complementary user entity controls | [Yes / No] |
| Business continuity certification or plan summary (for example ISO 22301) | Facility in scope; last exercise date | [Yes / No] |
| Data centre design or operation classification (for example ISO/IEC 22237 series or ANSI/TIA-942 based) | Claimed level matches the design you are buying; independent or self-declared | [Yes / No] |
| Payment card attestation where card data is hosted | Physical requirements in scope | [Yes / No / N/A] |
| Maintenance and test records summary (UPS, generator, cooling, fire) | Dates within the last 12 months | [Yes / No] |
| Incident history for the last 24 months | Power, cooling and security incidents with root cause | [Yes / No] |
| Insurance certificate and financial stability information | Cover type and amount; ownership changes | [Yes / No] |
| Environmental and climate risk statement | Flood, heat, water supply, grid risk | [Yes / No] |

## 5. Assessment checklist

<!-- Guidance: Score every item. Write the evidence seen (document reference, photo ID, observation), not "OK". Use N/A only with a reason. K = knock-out item. -->

### A. Site and location (weight 8)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-A-01 | Site risk assessment covers flood, seismic, industrial neighbours, flight paths and transport access | Provider risk summary, maps | | [0-3] | |
| DCA-A-02 | Building is discreet: no external signage that reveals the data centre purpose | Observation | | [0-3] | |
| DCA-A-03 | Distance to the other site (primary or recovery) is enough that one regional event does not hit both | Map, BIA | | [0-3] | |
| DCA-A-04 | Staff can reach the site during disruption (transport, parking, out-of-hours access) | Access procedure | | [0-3] | |

### B. Perimeter and building access (weight 14)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-B-01 | Layered perimeter: fence or building shell, reception, hall, cage | Observation, floor plan | | [0-3] | |
| DCA-B-02 | Every entry to the hall is logged to an individual (badge plus PIN or biometric) | Access system demo, log sample | K | [0-3] | |
| DCA-B-03 | Visitors are identified with a government ID, pre-registered by an authorised customer contact and escorted | Visitor procedure, log sample | | [0-3] | |
| DCA-B-04 | Anti-tailgating at hall entry (mantrap, turnstile or guard) | Observation | | [0-3] | |
| DCA-B-05 | Customer access list changes are processed only from authorised contacts and confirmed in writing | Ticket sample | | [0-3] | |
| DCA-B-06 | Organization can obtain its own access log for its cage on request within [5 working days] | Contract, sample | | [0-3] | |
| DCA-B-07 | Loading bay is separated from halls; deliveries are inspected and logged | Observation | | [0-3] | |
| DCA-B-08 | Cage or rack locks are individual; master keys controlled by provider key register | Key procedure | | [0-3] | |

### C. Power (weight 14)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-C-01 | Redundant utility feeds or documented single-feed risk with mitigation | Single-line diagram | | [0-3] | |
| DCA-C-02 | UPS with redundancy (for example N+1) and battery autonomy matching the generator start time | UPS design summary | | [0-3] | |
| DCA-C-03 | Generator capacity for full hall load with on-site fuel for [24 to 48 hours] *(Example)* and refuel contracts | Fuel contract, test log | K | [0-3] | |
| DCA-C-04 | Generator tested on load at the stated interval; results recorded | Test records last 12 months | | [0-3] | |
| DCA-C-05 | Dual power feeds (A and B) delivered to each rack from separate distribution paths | Observation, order form | | [0-3] | |
| DCA-C-06 | Power usage per rack monitored and reported to the customer | Portal demo | | [0-3] | |

### D. Cooling and environment (weight 10)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-D-01 | Cooling capacity with redundancy for the hall | Design summary | | [0-3] | |
| DCA-D-02 | Temperature and humidity monitored at rack inlet with alert thresholds agreed in the SLA | SLA, portal | | [0-3] | |
| DCA-D-03 | Leak detection under raised floors and around cooling units | Observation, test record | | [0-3] | |
| DCA-D-04 | Hot and cold aisle containment or equivalent airflow management | Observation | | [0-3] | |
| DCA-D-05 | Plan for extreme heat days (capacity margin, water supply for cooling where used) | Provider statement | | [0-3] | |

### E. Fire detection and suppression (weight 10)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-E-01 | Early warning smoke detection in the hall | Observation, maintenance record | K | [0-3] | |
| DCA-E-02 | Suppression system suitable for electrical equipment, zoned to limit impact | Design summary | | [0-3] | |
| DCA-E-03 | Fire systems inspected and tested at the interval set by local rules | Inspection certificate | | [0-3] | |
| DCA-E-04 | No combustible storage in halls; house rules enforced | Observation | | [0-3] | |
| DCA-E-05 | Customer notified of fire alarms and suppression events affecting its equipment | Notification procedure | | [0-3] | |

### F. Monitoring and operations (weight 8)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-F-01 | Operations centre staffed around the clock or with defined on-call | Staffing summary | | [0-3] | |
| DCA-F-02 | CCTV covers perimeter, entrances, halls and corridors; retention at least [30 days] *(Example)* | Observation, retention setting | | [0-3] | |
| DCA-F-03 | Security incidents and physical alarms are reported to customers within an agreed time | Contract, incident sample | | [0-3] | |
| DCA-F-04 | Provider staff are screened and trained; contractors escorted | HR summary, training record | | [0-3] | |

### G. Connectivity (weight 6)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-G-01 | Several carriers available; diverse building entry points | Carrier list, plan | | [0-3] | |
| DCA-G-02 | Meet-me room access controlled and logged | Observation | | [0-3] | |
| DCA-G-03 | Cross-connect orders and changes documented and confirmed to the customer | Order sample | | [0-3] | |

### H. Remote hands and change (weight 6)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-H-01 | Remote hands work only on tickets from authorised contacts, with identity check for phone requests | Procedure | | [0-3] | |
| DCA-H-02 | Remote hands staff follow customer instructions for media: no removal of drives without written approval | Procedure, contract | | [0-3] | |
| DCA-H-03 | Provider maintenance that may affect customers is announced in advance with a change window | Change notices sample | | [0-3] | |

### I. Contract, audit rights and exit (weight 12)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-I-01 | Right to receive independent assurance reports and certificates each year | Contract clause | K | [0-3] | |
| DCA-I-02 | Right to audit or visit, including after a security incident | Contract clause | | [0-3] | |
| DCA-I-03 | SLA for power and cooling availability with service credits and reporting | SLA | | [0-3] | |
| DCA-I-04 | Security incident notification duty with a time limit | Contract clause | | [0-3] | |
| DCA-I-05 | Subcontracting of security or operations needs notice to the customer | Contract clause | | [0-3] | |
| DCA-I-06 | Exit: notice period, support to move equipment, return of access cards and keys | Contract clause | | [0-3] | |

### J. Certifications and assurance (weight 8)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-J-01 | ISO/IEC 27001 certificate names this facility and is valid | Certificate, register check | | [0-3] | |
| DCA-J-02 | Independent assurance report covers this facility; exceptions reviewed | Report | | [0-3] | |
| DCA-J-03 | Complementary customer controls listed in reports are mapped to the organization's own controls | Mapping note | | [0-3] | |
| DCA-J-04 | Design or operation classification claims are supported by evidence | Certificate or statement | | [0-3] | |

### K. Climate and sustainability resilience (weight 4)

| ID | Check | Evidence expected | K | Score | Notes |
|---|---|---|---|---|---|
| DCA-K-01 | Provider has assessed climate-related hazards for the site (flood, heat, water, grid) | Statement, risk summary | | [0-3] | |
| DCA-K-02 | Energy efficiency and water use are reported, where relevant to customer requirements from clause 4.2 | Report | | [0-3] | |

## 6. Scoring summary and decision

<!-- Guidance: Recompute the totals with a spreadsheet or script, not by hand. Record the knock-out check separately from the score. Auditor check: the decision matches the band rules in section 3.3 and is signed by the risk owner. -->

### 6.1 Worked example: Quillmere Health Systems colocation suite

| Section | Weight | Section score (0 to 3) | Weighted points |
|---|---|---|---|
| A. Site and location *(Example)* | 8 | 2.50 | 6.67 |
| B. Perimeter and building access *(Example)* | 14 | 2.75 | 12.83 |
| C. Power *(Example)* | 14 | 2.50 | 11.67 |
| D. Cooling and environment *(Example)* | 10 | 2.40 | 8.00 |
| E. Fire detection and suppression *(Example)* | 10 | 2.00 | 6.67 |
| F. Monitoring and operations *(Example)* | 8 | 2.50 | 6.67 |
| G. Connectivity *(Example)* | 6 | 3.00 | 6.00 |
| H. Remote hands and change *(Example)* | 6 | 2.00 | 4.00 |
| I. Contract, audit rights and exit *(Example)* | 12 | 1.50 | 6.00 |
| J. Certifications and assurance *(Example)* | 8 | 2.75 | 7.33 |
| K. Climate and sustainability resilience *(Example)* | 4 | 2.00 | 2.67 |
| **Total *(Example)*** | **100** | | **78.5** |

Section scores are averages of whole-number item scores (B: 22 of 24
points over 8 items; C: 15 of 18 over 6 items). Weighted points are
rounded to two decimals; the total is computed from unrounded values. Knock-out check: no K item scored 0. The lowest
K item was DCA-I-01 (score 1: reports available only under a separate
NDA request each year, no contractual right).

**Decision *(Example)*:** 78.5 falls in the band "Acceptable with action
plan". The risk owner accepted with actions ACT-001 to ACT-003, a
re-check of section I within 6 months, and risk RISK-044 kept at
Medium in DOC-ISMS-016.

### 6.2 Decision record

| Field | Value |
|---|---|
| Total score and band | [nn.n, band] |
| Knock-out items at 0 | [None / list] |
| Decision | [Accepted / Accepted with action plan / Not acceptable] |
| Conditions | [list] |
| Risk register update | [RISK-NNN, new score] |
| Decided by and date | [@risk-owner], YYYY-MM-DD |
| Next assessment due | YYYY-MM-DD |

## 7. Findings and action plan

<!-- Guidance: One row per gap. Contract gaps go to procurement and legal; technical gaps to the provider through the account manager. Track actions to closure and re-score the item. -->

| Action ID | Item | Finding | Action | Owner | Due | Status |
|---|---|---|---|---|---|---|
| ACT-001 *(Example)* | DCA-I-01 | No contractual right to annual assurance reports | Add assurance report clause at renewal (amendment signed) | [@procurement-lead] | 2027-06-30 | Closed 2027-06-15 |
| ACT-002 *(Example)* | DCA-E-03 | Fire suppression inspection certificate 14 months old | Obtain current certificate from provider | [@it-infrastructure-lead] | 2027-04-30 | Open |
| ACT-003 *(Example)* | DCA-H-02 | Remote hands terms silent on drive removal | Written instruction filed with provider; confirm in next contract amendment | [@it-ops-lead] | 2027-05-31 | Open |
| [ACT-NNN] | [item] | [finding] | [action] | [@owner] | YYYY-MM-DD | [Open / Closed] |

## 8. Size tiers

<!-- Guidance: The library's working tiers, using the shared fictional settings. Pitfall: a small company that only uses public cloud filling this in for its cloud provider; use supplier assessment instead. -->

| Topic | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Facilities | None of its own; production on one public cloud provider in two regions | One colocation suite (primary production for the managed service) | One own group data centre plus any colocation used by country units |
| Use of this template | Not used for the cloud regions: assess the provider through reports under `compliance/supplier-security-assessment`. Use only if a colocation rack is added later | Pre-contract and annual assessment with a site visit by the infrastructure lead and a security team member | Annual self-assessment of the own data centre (sections I and J adapted to internal service agreements) and annual assessment of each colocation site |
| Assessors | Not applicable | 2 people, one day on site | Security office plus site facilities; internal audit samples one facility per year |
| Reporting | Not applicable | Steering committee and management review | Group steering committee, site results consolidated |

## 9. Records and evidence

<!-- Guidance: Records that prove supplier monitoring and physical assurance. Map them in the control evidence matrix. -->

| Record | Owner | Location | Retention |
|---|---|---|---|
| Completed assessment with scores and decision | IT infrastructure lead | [GRC tool or document system] | Contract plus [3 years] |
| Evidence pack (certificates, reports, test records) | IT infrastructure lead | [Restricted folder] | Contract plus [3 years] |
| Site visit notes and photos (where allowed) | Lead assessor | [Restricted folder] | Contract plus [3 years] |
| Action plan and closure evidence | ISMS manager | Section 7 and DOC-ISMS-088 | Until closed plus [3 years] |
| Access list reconciliations for the cage | IT operations | [Ticket system] | [3 years] |

Map these records under A.5.22 and A.7 in the control evidence matrix
(DOC-ISMS-033, `isms/control-evidence-matrix`) and link the supplier
entry in DOC-ISMS-066.

## 10. References

<!-- Guidance: Cite editions exactly. Industry design standards are named as examples only. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 2024-02-23 | Annex A A.5.19 to A.5.22, A.5.30, A.7. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002:2022 | 2022 | Control guidance. https://www.iso.org/standard/75652.html |
| ISO/IEC 27036-1:2021 | 2021 | Supplier relationships overview. https://www.iso.org/standard/82905.html |
| ISO/IEC 27031:2025 | 2025 | ICT readiness for business continuity. https://www.iso.org/standard/80975.html |
| ISO 22301:2019 + Amd 1:2024 | 2019, Amd 2024 | Business continuity management. https://www.iso.org/standard/75106.html |
| ISO/IEC 22237 series (data centre facilities and infrastructure) | Part 1: 2021; check the current edition of each part | Example of a design and operation classification |

Related templates: `isms/physical-security-policy`,
`isms/supplier-register`, `isms/supplier-security-agreement-27036`,
`compliance/supplier-security-assessment`,
`compliance/business-impact-analysis`,
`isms/ict-readiness-business-continuity-plan`,
`ops/disaster-recovery-plan`, `isms/equipment-disposal-reuse-record`,
`isms/cloud-services-security-policy`, `isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex
A controls A.5.19 to A.5.22, A.5.30 and A.7.1 to A.7.14, with guidance
from ISO/IEC 27002:2022. The checklist, weights, scoring model and
examples are original wording; no ISO/IEC text is reproduced, and the
named certifications and design standards are examples, not
recommendations of any provider. You need the official standards to
apply the controls: https://www.iso.org/standard/82875.html. Check the
current edition of each reference before use. This is a documentation
format, not legal advice. Quillmere names are fictional. Template
licence: MIT.