In a colocation facility, the operator’s physical security duty generally stops at the hall door plus common-area monitoring. Per-rack access, cage integrity, and audit evidence remain the tenant’s responsibility. If that boundary is not named in the contract, you get an uncovered gap or security you have effectively bought twice. I’ve found that most disputes begin with an unread annexure, an unverified camera view, or an escort process two teams assumed the other owned. This guide draws the line. You will learn what the operator owes tenants, where hall door, perimeter, and common-area monitoring end, how escorted access and incident notification work, and what tenants must own themselves: per-rack access, cage integrity, audit evidence, and contractor escorts. We will compare duties in an operator versus tenant matrix, expose the grey zone where gaps and double-spend hide, and show how to name the boundary before you sign. You will also get FAQs on rack, cage, and escort duty, plus a pro tip on annexing the matrix instead of emailing it. No assumptions. No duplicate spend. No unowned risk.

The Short Answer: Where the Operator’s Duty Stops

In most colocation agreements, the operator’s duty stops at the hall door and common-area monitoring; per-rack access, cage integrity and audit evidence remain yours.

This is contractual practice, not law, holding only as firmly as the Master Service Agreement and Rack Service Schedule you sign. Providers draw it differently.

Data storage and processing is a recognised critical infrastructure category under the SOCI Act 2018. Positive security obligations sit with the responsible entity, not automatically with you as tenant; the CIRMP must demonstrate physical security layers, binding since December 2024.

CISC consultations on streamlining the Act and enhancing CIRMP Rules were active in 2026; confirm status before promising compliance.

The damage: an unpriced gap, plus security bought twice.

What the Colocation Operator Owes Tenants

In most colocation agreements, the operator’s side covers five things. The perimeter (fencing, bollards, vehicle screening, mantraps, lobby identity checks) is usually compressed into “controlled facility access.” Hall and corridor controls (doors, turnstiles) get people to your cage door, not through it. Common-area CCTV covers halls, lift lobbies and loading docks; insist the retention window is stated in days. Life safety and resilience sit with the operator: suppression, UPS, generator, leak detection and temperature control, typically aligned to standards such as ANSI/TIA-942. Finally, a duty to notify: what failed, how fast, and which named contact. Get that contact in the schedule, the same discipline body corporate security rules demand for shared-space access.

Hall Door, Perimeter and Common-Area Monitoring

Once the SLA’s perimeter promises are documented, push into the monitoring detail behind them. Ask for the exact camera count, field of view and retention period covering the halls, lift lobbies and docks your racks depend on, quoted in days, in writing.

Then test the commercial terms: are footage requests free, charged per request, or capped annually, and what turnaround time is committed? In my experience, most tenants discover a per-request fee only after an incident.

Finally, confirm how visitor logs and door access records are stored, in what format, and whether you can obtain copies without a formal legal process. Reviewing data management and retention policies for visitor information is worth doing before you agree a retention window.

Escorted Access and Incident Notification

Escort duty is where the hand-off most often breaks. Most operators escort visitors to the shared hall door and stop there, so escort hours, booking lead times and after-hours rates belong in the schedule you sign, not in a sales email. Under-specified escort clauses fail the same way as data centre guard contract clauses: the clause, not the guard, is the problem.

Get the notification window in writing: minutes for a power or cooling event, days for a suspected intrusion or breach, each with a named contact.

If your organisation is a captured entity, the operator’s ACSC notification does not discharge your own reporting obligation.

What Tenants Must Own Themselves

Once escorts stop at the hall door, your obligations begin. You own who enters your rack or cage: locks, card readers, biometrics and access list, not the operator’s front desk. You own cameras inside your cage and along your rack row, plus cabling approvals, power and network the operator must provision. As with cameras in shared buildings, governance is yours. Book and pay for contractor escorts for your electricians, cablers, auditors and hardware vendors, in-house or via a service. Control assets with tamper seals, tagged serials, removal permits and media destruction certificates. Maintain evidence packs for auditors and insurers: access history, imagery exports and chain-of-custody records you can produce on request.

Per-Rack Access and Cage Integrity

Owning your cage also means owning who can reach it. In shared cages, a neighbour’s access decision changes your risk, so request the cage-level access list and the written process for changing it, including approval turnaround and removal rules. In my experience, most tenants never see that list until an incident. Then check coverage: the cage door and the aisle inside it need cameras, because a hall camera rarely proves who touched your rack. Fit tamper-evident seals and photograph a baseline at install, so a physical audit compares against something concrete. Log each requirement in your Table of Contents.

Audit Evidence and Contractor Escorts

Tamper seals only help if you can pair them with a record. Negotiate a written route for operator access logs and shared-area footage: cost per request, file format, and a committed turnaround, ideally in the Rack Service Schedule. Publish an escort policy covering your own vendors, with named approvers, induction steps and out-of-hours rules, and follow good practice for managing visitors and contractors safely. Then keep your own register: who entered, what they touched, and the change ticket that authorised it. In my experience, that register, not the operator’s front-desk sign-in sheet, is the evidence an auditor will ask for.

Operator vs Tenant: Security Responsibility Matrix

Escort routes agreed: one owner per control. Read this against your signed Rack Service Schedule, not the sales deck, because shared rows are gaps until one party is named. Where the operator sells none, CCTV and alarm monitoring covers your side without duplicating hall coverage already paid for. Concierge security duties need the same rigour.

The Grey Zone Where Gaps and Double-Spend Hide

The matrix exposes gaps, not owners. A hall camera may see your cage door but not your rack row, and 30-day retention will not survive a 90-day investigation. Escort duty fractures the same way: the operator takes your contractor to the hall, you take them inside the cage, and someone stands unescorted because both sides assumed cover. Recording is not response; a camera that stores footage is not a camera someone watches, and after-hours attendance is a separate line, which is where mobile patrol fits. Insurers expect evidence the MSA never obliges the operator to hand over. Where you need a person rather than a lens, static security guards can cover tenant-side escort and access duties inside your own footprint.

Naming the Boundary Before You Sign

The fix is contractual, not operational. Annex the responsibility matrix to the Rack Service Schedule itself, so it survives account manager turnover and facility acquisitions. Then define measurable commitments: footage request turnaround, escort booking lead time, incident notification window and access log format.

Add an overlap clause naming what neither party will do, plus a named 2am escalation contact for unassigned duties. Price gaps before signing. Escort hours, extra cage cameras, rack-level readers and evidence requests never get cheaper as variations later. Review annually, and again whenever you add cages, expand into a second hall, or SOCI and CIRMP obligations shift.

FAQs on Colocation Rack, Cage and Escort Duty

With the boundary in the schedule, these recur.

Who monitors cameras in a colocation cage? You do. Operators watch common areas; in-cage coverage is yours to install, monitor and retain.

Does the operator escort my contractors? Usually to the hall door only. Inside your cage, you escort them or book a service.

Who holds the audit evidence? Both sides. Secure a right to operator access logs and shared-area footage, and keep your own cage records.

Is the operator responsible for my rack access control? Rarely. Rack and cage locks and readers are normally tenant-supplied and tenant-managed.

Does the SOCI Act capture my colocation provider? Data storage and processing is a recognised category, but scope depends on the asset and responsible entity. Check current CISC guidance, not assumptions.

Pro Tip: Annex the Matrix, Do Not Email It

FAQs settle the theory. The annexure settles the invoice: turn the responsibility table into a numbered annexure of your Rack Service Schedule, listing named contacts, response times and prices for every tenant-side duty. Re-test it at each renewal, because facility acquisitions and account manager turnover quietly rewrite unwritten assumptions.

The pitfall is paying twice: tenants routinely buy common-area monitoring the operator already provides while leaving their own cage uncovered. Before renewal, map every matrix row to a clause, a dollar figure and one accountable owner. Any row you cannot map is risk you are carrying. Where the gap is tenant-side escorting or after-hours cover, book tenant-side static guard cover rather than assuming the hall camera does it.

Conclusion

The line is simple: the operator secures the hall, the perimeter and common areas; you secure the rack, the cage and everything inside it. I’ve found that the gaps and double-spend hide in the grey zone, where nobody owns escorting, after-hours cover or audit evidence.

Map every matrix row to a clause, a dollar figure and one accountable owner. If escorting or after-hours cover falls to you, book tenant-side static guard cover rather than assuming the hall camera does it. Pair that with CCTV and alarm monitoring for your own cage records.

Pro tip: annex the responsibility matrix to your Rack Service Schedule and re-test it at every renewal. Any row you cannot map is risk you are carrying.