Data Center Compliance
SOC 2, HIPAA, PCI DSS, ISO 27001, FedRAMP and CMMC: What a Colocation Facility Covers, What You Still Own, and How to Audit It
A colocation facility can carry a long list of certifications and still leave gaps in your audit. We match your frameworks to facilities whose reports actually cover your space and services, and check the documents before you sign.
Match My Compliance RequirementsEvery major colocation operator advertises certifications. What matters for your audit is narrower: whether the facility's current reports cover the specific building and services you use, whether the observation period is recent, and how its controls map to the data center compliance standards your auditors, regulators and customers apply. This guide covers the main frameworks, what a facility provides under each, the documents to request, and a data center audit checklist you can use before signing. It is written for companies choosing compliant colocation, not as legal advice; confirm your obligations with counsel and your auditor.
Sources: PCI Security Standards Council; CMMC status per The Defense Compliance Report; HIPAA rulemaking timeline per Davis Wright Tremaine. As of October 2026.
We request the current SOC 2, ISO and PCI documents under NDA and check scope, dates and exceptions before you shortlist a building.
HIPAA, PCI, SOC 2, CMMC, NYDFS or client audit demands: we match what you must prove to what each facility can document.
Business associate agreements, audit rights, incident notice and access logging negotiated into the contract, not promised in a sales call.
The operator you choose pays us. Your rate is not marked up, and you'll hear back within 24 hours.
Data Center Compliance Standards at a Glance
A facility's certifications cover its own controls. Your auditor relies on them for the physical and environmental parts of your program and tests everything else in your environment. This is the shared responsibility model, and it is the single most useful idea in colocation compliance.
| Framework | Who needs it | What the facility provides | What you still own | Ask the facility for |
|---|---|---|---|---|
| SOC 2 Type II | Most B2B and SaaS companies, and anyone whose customers ask | Tested controls for security and availability at the facility | Your systems, access, change management and policies | Current SOC 2 Type II report and bridge letter |
| SOC 1 Type II | Companies whose systems affect financial reporting | Controls relevant to customers' financial statements | Your financial and IT general controls | SOC 1 Type II report |
| ISO/IEC 27001:2022 | International and enterprise buyers | A certified information security management system for the site | Your own ISMS, if you need certification | Certificate and statement of applicability scope |
| PCI DSS 4.0.1 | Anyone storing, processing or transmitting card data | Physical security controls (Requirement 9) for the cardholder data environment | Network segmentation, encryption, logging and testing | Attestation of Compliance and responsibility matrix |
| HIPAA | Healthcare providers, plans and their business associates | Physical safeguards; a business associate agreement where it applies | Risk analysis, technical safeguards and policies | BAA and evidence of physical safeguards |
| HITRUST | Healthcare organizations needing one certifiable framework | HITRUST-certified facility controls you can inherit | Your own HITRUST assessment | HITRUST certification letter and inheritance options |
| FedRAMP and CMMC | Federal cloud providers and defense contractors | Physical and environmental (PE) controls | System security plan, NIST SP 800-171 controls and assessments | Customer responsibility matrix and PE control evidence |
Framework descriptions summarized from the standards bodies; facility coverage varies by operator and building. Confirm scope in each report.
Send the frameworks your customers, auditors or regulators ask about, plus power, cabinet count and location. You'll hear back within 24 hours with the facilities whose reports cover them.
SOC 2 for Data Centers
A SOC 2 data center report is an independent auditor's opinion on the facility's controls against the AICPA Trust Services Criteria, most often security and availability. A Type I report checks that controls are designed properly at a point in time; a Type II report tests that they operated over a period, usually three to twelve months. For colocation, Type II is the one your auditor wants, and three details decide whether it helps you:
Scope
Is your building, and the services you buy (remote hands, cross-connects, managed services), named in the report? Many operators issue reports by region or by facility group.
Dates
A report whose period ended long ago does not cover today. Ask for the bridge letter that covers the gap to the present.
Exceptions and user controls
Read the exceptions section and the complementary user entity controls: the things the facility assumes you are doing.
SOC 1 vs SOC 2 for a data center
SOC 1 covers controls relevant to customers' financial reporting; SOC 2 covers security, availability, processing integrity, confidentiality and privacy. Public companies and others whose systems feed financial statements usually need the facility's SOC 1 for their SOX auditors; most other buyers need SOC 2. Large operators commonly publish both.
SOC 2 vs ISO 27001
| SOC 2 | ISO/IEC 27001 | |
|---|---|---|
| What it is | An attestation report from a CPA firm on how controls are designed and operate | A certification that the site runs a compliant information security management system |
| What you receive | A detailed report of the controls tested, results and any exceptions | A certificate, plus the scope and statement of applicability on request |
| Period | Type II covers an observation period, usually 3 to 12 months, reissued yearly | A three-year certificate with annual surveillance audits |
| Where it is expected | Mainly US customers and security questionnaires | International and enterprise buyers |
| For colocation | Shows your auditor exactly what was tested | Shows the operator runs a managed security program |
Neither replaces the other. Most large operators hold both, and the SOC 2 report is usually the more useful document for your own audit because it shows what was tested and what failed.
ISO 27001 and PCI DSS
ISO/IEC 27001:2022
An ISO 27001 data center runs a certified information security management system. The transition from the 2013 version ended on October 31, 2025, so current certificates should reference 2022. Check that the certificate's scope names your site.
PCI DSS 4.0.1
A PCI compliant data center provides an Attestation of Compliance covering physical security for the cardholder data environment, mainly Requirement 9. It does not make your environment compliant: segmentation, encryption, logging and testing remain yours. Ask for the responsibility matrix that splits the requirements.
HIPAA and HITRUST
HIPAA does not certify data centers. A facility supports your compliance with physical safeguards and, where it has access to systems holding electronic protected health information, a business associate agreement. HHS proposed the first major update to the Security Rule since 2013 in January 2025, but as of October 2026 it is still a proposed rule, and HHS has pushed its target for a final rule to July 2027. The current Security Rule remains in force. Healthcare requirements, BAAs and facility choice are covered on HIPAA compliant colocation.
FedRAMP, CMMC and NIST 800-171
CMMC
Phase 1 took effect on November 10, 2025, requiring Level 1 and Level 2 self-assessments in applicable defense contracts. Phase 2, third-party Level 2 certification planned for November 10, 2026, was suspended on July 13, 2026 with no replacement date announced.
NIST SP 800-171
The 110 security requirements behind CMMC Level 2. A facility covers the physical protection family; the rest is yours. Ask for a customer responsibility matrix.
FedRAMP
Authorizes cloud services, not buildings. A colocation facility supports a FedRAMP system through physical and environmental controls the provider inherits.
CMMC status per The Defense Compliance Report and Dorsey & Whitney. Check the clause in your own contract.
Financial Services Rules
Banks, broker-dealers, advisers, insurers and fintechs answer to rules that reach their infrastructure providers. NYDFS Part 500, amended in 2023 with its last requirements phased in by November 2025, requires a third-party service provider policy for DFS-licensed firms. The SEC's Regulation S-P amendments, with compliance dates of December 3, 2025 for larger firms and June 3, 2026 for smaller ones, require service provider oversight, including notice within 72 hours of a breach affecting customer information. FINRA Rule 4370 requires business continuity plans, which shape recovery site choices. Trading-specific facility choices are on financial services colocation.
Data Residency Requirements
Data residency requirements come from laws, contracts and customers that require data to stay in a particular country, state or facility. Federal workloads often require US-only hosting and US-person access; some Canadian provinces restrict where public-sector data can sit; and European privacy law restricts transfers abroad rather than requiring local storage. Colocation makes residency simple to prove, because you know the exact building your hardware is in, and contracts can bar the operator from moving it. Confirm with counsel which rules reach your data.
Law Firms and Professional Services
Law firms carry an ethical duty under ABA Model Rule 1.6(c) to make reasonable efforts to prevent unauthorized access to client information, and the duty of technological competence under Rule 1.1. ABA Formal Opinion 512, issued in July 2024, extended that thinking to generative AI tools. In practice, firms are asked for facility evidence in client security questionnaires and outside counsel guidelines, so a facility's SOC 2 report, access controls and incident notice terms become part of winning work. Firms serving banks and insurers also inherit their clients' NYDFS and Reg S-P expectations.
Data Center Physical Security Requirements
Most data center security standards converge on the same physical controls. These are what a SOC 2 or ISO 27001 auditor tests at the facility, and what you should see on a tour.
Perimeter and entry
Fencing, vehicle barriers, staffed entrances around the clock, badge plus biometric entry, and mantraps into data halls.
Visibility
Camera coverage of entrances, halls and cages, with footage retained for a defined period you can request.
People
Background-checked staff, visitor logging and escorts, and periodic access reviews you can audit for your own space.
Your space
Locked cabinets or cages, access lists you control, and logs of every entry, including remote hands work.
Data Center Audit Checklist
The SOC 2 and ISO 27001 reports name your building and the services you will use.
The SOC 2 observation period ended within the last year, with a bridge letter to today.
Any exceptions in the report are understood and do not touch your controls.
You can meet the complementary controls the facility expects of you.
For card data, the split of PCI DSS 4.0.1 requirements between you and the facility.
For PHI, a business associate agreement reviewed by counsel.
How access to your space is granted, logged and reported to you.
How fast the facility tells you about a security incident affecting you.
Your right to request reports annually and to tour or audit on notice.
Your recovery facility carries the same reports, so failover does not break compliance.
How We Find Compliant Colocation
You send the requirement
Frameworks, power, cabinet count, location and date. You'll hear back within 24 hours.
We check the documents
Current reports, scope, dates, exceptions and BAA terms for each facility that fits, before you shortlist.
We negotiate and you sign
Rate, audit rights, incident notice, access logging and exit terms negotiated before you sign. The operator you choose pays us.
Frequently Asked Questions
What is data center compliance?
The ability of a data center to prove, through independent reports and certifications, that its physical and operational controls meet the frameworks its customers answer to, such as SOC 2, ISO 27001, PCI DSS and HIPAA. For a colocation tenant, the facility covers its own controls and you cover your systems and data.
What certifications should a colocation data center have?
For most buyers: a current SOC 2 Type II report, ISO/IEC 27001:2022 certification, and a PCI DSS Attestation of Compliance. Add SOC 1 for financial reporting, a business associate agreement and possibly HITRUST for healthcare, and documented physical controls for FedRAMP or CMMC work.
Does a SOC 2 compliant data center make my company SOC 2 compliant?
No. Your auditor relies on the facility's report for the physical and environmental controls, then tests your own systems, access, change management and policies. The facility's report helps; it does not replace yours.
What is the difference between SOC 1 and SOC 2 for a data center?
SOC 1 covers controls relevant to customers' financial reporting and is used by SOX auditors. SOC 2 covers security, availability, processing integrity, confidentiality and privacy, and is what most customers and security questionnaires ask for. Large operators usually publish both.
What is a SOC 2 bridge letter?
A letter from the facility stating that no material changes to its controls occurred between the end of its last SOC 2 observation period and today. It covers the gap until the next report is issued.
Is a PCI compliant data center enough for PCI DSS?
No. The facility's Attestation of Compliance covers physical security for your cardholder data environment. Network segmentation, encryption, logging, vulnerability management and testing remain your responsibility under PCI DSS 4.0.1.
Do colocation providers sign HIPAA business associate agreements?
Many do, particularly where staff have access to systems holding electronic protected health information, for example through remote hands. Terms vary, so have counsel review the BAA before signing. HIPAA itself does not certify data centers.
Has the HIPAA Security Rule changed in 2026?
Not yet. HHS proposed a major update in January 2025, but as of October 2026 it remains a proposed rule and HHS has moved its target for a final rule to July 2027. The current Security Rule remains in force.
Is CMMC in effect?
Yes, in part. Phase 1 began on November 10, 2025, requiring Level 1 and Level 2 self-assessments in applicable defense contracts. Phase 2, third-party Level 2 certification planned for November 10, 2026, was suspended on July 13, 2026, with no replacement date announced.
Can a colocation facility be FedRAMP authorized?
FedRAMP authorizes cloud services, not buildings. Colocation facilities support FedRAMP systems by providing physical and environmental controls that the cloud provider inherits, documented in a customer responsibility matrix.
What are data center physical security requirements?
Common requirements include perimeter controls, staffed security around the clock, multi-factor entry such as badge plus biometrics, mantraps, camera coverage with retained footage, visitor logging and escorts, locked cabinets or cages, and documented access reviews. The facility's SOC 2 report should test them.
What is a data center audit?
An assessment of a facility's controls, usually performed by an independent auditor for SOC reports or a certification body for ISO 27001, plus your own due diligence: reviewing those reports, touring the site and confirming the contract supports your obligations.
How do law firms meet data security obligations in colocation?
By choosing facilities with current SOC 2 Type II reports and strong physical controls, documenting the due diligence, negotiating incident notice and audit rights, and keeping client security questionnaire evidence ready. ABA Model Rule 1.6(c) and Formal Opinion 512 frame the duty.
What data center rules apply to financial services firms?
Depending on the firm: NYDFS Part 500 third-party service provider requirements, the SEC's amended Regulation S-P, with compliance dates in December 2025 and June 2026, FINRA Rule 4370 business continuity, and SOX for financial reporting controls.
Do you charge for finding compliant colocation?
No. The operator you choose pays us from its channel budget, and your rate is not marked up. You'll hear back within 24 hours.
Match Your Compliance Requirements
Tell us the frameworks you answer to, plus power, cabinet count and location. You'll hear back within 24 hours from the person who will run your search. No cost, no obligation, and the operator you choose pays us.
Once you have contacted an operator directly, it usually will not work through an advisor on your deal.
By industry: HIPAA compliant colocation and financial services colocation.
Facility standards: data center tiers, disaster recovery colocation and Northern Virginia colocation for federal and CMMC work.
Planning: colocation pricing, data center lease terms, data center consulting and how a data center broker works.
