Colocation Compliance & Certifications
If your workload is regulated, compliance evidence is not optional—it is a contract requirement. But colocation certifications are not all equal, and a corporate-wide badge does not mean your specific building and hall are covered. This guide explains what each certification covers, what evidence to request, and how to verify building-level scope before signing.
Common colocation certifications
| Certification | What it covers | Who needs it |
|---|---|---|
| SOC 2 Type II | Security, availability, processing integrity, confidentiality, privacy controls | Most enterprise buyers—general security baseline |
| ISO 27001 | Information security management system (ISMS) | International buyers, enterprises with global operations |
| PCI-DSS | Payment card data security | Any workload processing, storing, or transmitting cardholder data |
| HIPAA | Protected health information (PHI) security and privacy | Healthcare, health tech, and any workload handling PHI |
| FedRAMP | Federal cloud/security authorization | Federal government contractors and agencies |
| FISMA | Federal information security modernization act | Federal agencies and contractors |
| NIST 800-53 | Security controls for federal systems | Federal, defense, and high-security workloads |
What to request from the provider
A provider saying "we are SOC 2 certified" is not sufficient. Request the SOC 2 Type II report, check whether it covers your building, and review any exceptions. If the report is more than 12 months old, ask for a bridge letter.
Add sustainability and energy reporting questions to the same request.
- The actual audit report or certification document—not a badge on a website
- Building-specific scope: does the certification cover your specific facility and hall?
- Audit date and renewal cycle: is the report current (typically annual)?
- Any exceptions, qualifications, or noted control deficiencies in the report
- Bridge letters if the audit period has lapsed since the last report
Building-level vs corporate-wide scope
Many providers hold certifications at the corporate level but the audit scope may not include every building. A provider could be SOC 2 certified at their headquarters and primary data center, but not at a facility they acquired or a secondary building. Verify that the certification scope explicitly names the facility you will occupy.
For PCI-DSS and FedRAMP, scope is even more critical—these certifications are typically facility-specific or workload-specific, not corporate-wide. Ask for the exact scope statement in the audit report.
Our checklist covers what to verify during a data center tour, including building-scoped reports.
Shared responsibility: what you own vs what the provider owns
Colocation compliance is shared. The provider is responsible for physical security, facility controls, and infrastructure—evidenced by their certifications. You are responsible for your hardware, software configuration, data handling, and access controls. A SOC 2 report from the provider covers their controls, not yours.
For regulated workloads (PCI, HIPAA, FedRAMP), you typically need your own compliance program layered on top of the provider's facility certifications. The provider's certification is necessary but not sufficient—you must also implement and audit your own controls.
Compliance and your contract
If compliance evidence is a condition of your colocation decision, make it a contract term: require the provider to maintain the specified certifications for the duration of your term, provide annual renewal reports, and notify you of any scope changes or lapses. A certification that lapses mid-contract can put your compliance posture at risk.
Related Guides
Ready to compare providers?
Get matched quotes from multiple facilities or talk through your requirements with an expert.