The Concern
A growing colocation operator was in advanced talks to host a hyperscale client. Read More
What We Did
Defined the question. With the head of operations and the compliance lead, we agreed three questions. Read More
What We Found
The core controls were sound. The gaps were in how the controls were managed in day-to-day operations. Read More
The Outcome
Gaps closed before the review: All priority findings were fixed within [X weeks], before the client’s security review began. Read More
The Concern
A growing colocation operator was in advanced talks to host a hyperscale client. Before signing, the client would carry out its own security review of the facility, and the result would weigh heavily in the final decision.
On paper, the operator was well prepared. It held the relevant certifications, used multi-layered access control into its data halls, ran 24/7 monitoring and had passed its most recent audit without major findings.
Leadership was still concerned. An audit checks whether controls exist, but not always whether they hold up across hundreds of daily movements by contractors, maintenance crews, vendor engineers and client technicians. The internal team had designed many of the controls itself, which made an objective view difficult. A formal audit firm would mostly check documents against standards. The operator wanted an independent, practical assessment of how its security performed day to day, finished well before the client review.
What We Did
- Defined the question. With the head of operations and the compliance lead, we agreed three questions. Did access controls work as designed in daily operations? Were third-party risks managed consistently? Was there anything a demanding client would find that the operator didn’t already know about?
- Reviewed access across its whole life. We examined how credentials for employees, contractors, vendors and client personnel were requested, approved, issued, used and revoked. We then reconciled active credentials against current contracts, staffing records and access logs.
- Observed operations as they actually ran. We reviewed entry points, escort practices, loading and delivery areas, and equipment movement during normal hours and at shift changes, and compared what we saw with the written procedures.
- Tested the third-party chain. We checked how contractors and subcontractors were screened before getting site access, and whether verification requirements were followed all the way down the supply chain.
- Made it actionable. Leadership received a structured report that ranked findings by risk, kept confirmed issues separate from observations, and set out a prioritised remediation plan matched to the client review timeline.
What We Found
The core controls were sound. The gaps were in how the controls were managed in day-to-day operations.
- Some credentials outlived their purpose. A number of contractor access credentials were still active after the projects they had been issued for had ended.
- Escort practice was inconsistent. Third-party personnel were escorted properly during regular hours, but less consistently at shift changes and during busy maintenance windows.
- Verification stopped at the first tier. Primary vendors met the operator’s screening requirements, but their subcontractors had not always been held to the same standard.
- Asset movement checks varied. Checks on equipment entering and leaving the facility were done differently from shift to shift, with limited reconciliation.
None of this meant a breach had happened. But each was the kind of finding that shakes a hyperscale client’s confidence. Taken together, they showed that the controls worked better on paper than in practice.
The Outcome
- Gaps closed before the review: All priority findings were fixed within [X weeks], before the client’s security review began.
- A confident client review: The operator went into the review knowing its controls had already been independently tested, and it could show evidence of continuous improvement.
- Stronger third-party controls: Screening requirements were extended to subcontractors, and access was tied to contract duration and set to expire automatically.
- Ongoing assurance: On our recommendation, the operator introduced quarterly access reconciliations, unannounced compliance checks at shift changes and standardised asset movement logs.