Colocation facilities house equipment from multiple tenants—competing companies, often operating sensitive systems. The colocation provider's primary security obligation is preventing cross-tenant access: ensuring that equipment and data of one tenant is not accessible to another, and that physical infrastructure failures don't cascade across tenant racks.
The multi-tenant model creates unique security challenges. Unlike a single-tenant data center where all staff are employed by the same organization, a colocation facility hosts vendors, contractors, customers' technicians, and colocation staff. Physical boundaries must be strong enough to prevent accidental or intentional cross-tenant access.
Physical Separation of Tenant Space
The foundation of tenant security is physical separation. Each tenant's rack or cage should be clearly demarcated, ideally with physical barriers (fencing, walls, separate rooms). For high-security tenants, dedicated cages with separate doors, locks, and access control provide fortress-like separation. For standard tenants, clear tape on the floor and signage defining boundaries are less effective but create operational awareness.
Cable management requires attention: tenant network cables, power cables, and serial connections must not be mingled with other tenants' infrastructure. A contractor might accidentally or deliberately cut another tenant's cables, disrupting service and potentially causing damage. Some colocation facilities use color-coded cables and segregated cable trays to prevent this risk.
Access Control and Tenant Management
- Badging and Escort: Each tenant should have a unique badge or access credential that unlocks only their cage or rack area. No tenant should be able to access shared or unrelated tenant areas. Implement escort requirements: unescorted access only to tenant's own space, escort required for public areas.
- Key and Lock Management: Each tenant cage should have a unique lock, with keys issued only to authorized tenant personnel. The colocation facility should maintain a master key but only use it in emergencies or tenant-approved scenarios. Document all key issuance and master key usage.
- Environmental Controls: Power distribution and cooling systems should be segregated by tenant. A power failure affecting one tenant should not disable another. Some facilities use power distribution units (PDUs) per tenant, others segregate PDU branches by tenant. This adds cost but prevents cascading failures and limits liability.
- Camera Coverage: Fixed cameras should cover all common areas and equipment racks. Cameras should have high enough resolution to identify individuals. Review video access permissions: tenants may request camera access to their own space; define policies on what is available to tenants and what is retained by the facility for security purposes.
Tenant Onboarding and Off-boarding
When a tenant moves into colocation, verify their identity and authorized personnel. Issue badges for their staff. Brief them on facility policies: acceptable use, equipment restrictions, prohibited areas. Clarify incident notification procedures: if they detect suspicious activity, who do they notify?
When a tenant departs, recover their badges, change their locks, document the final state of their space (photos), and securely remove any shared information. If the tenant was in compliance with security policies, this is routine. If there were security incidents, conduct a post-incident review.
Colocation security is a balance between openness (allowing tenants operational flexibility) and security (preventing cross-tenant compromise). We help colocation facilities design and implement tenant separation frameworks that protect all occupants. Let's discuss your colocation security model.
This article was written by the Cascadia OT Security practice, which advises Pacific Northwest data centers and manufacturers on industrial cybersecurity. For engagement inquiries, reach our practice team.