Control need · Data centre and colocation exposure

You own the racks. You rarely own every route into them.

Colocation gives you space, power and connectivity. It also brings shared fabric, provider engineers, remote hands and out-of-band management planes. Physical Control governs which of those routes exists, and when.

See what Control changes What is Control

As featured in

What is exposed

The estate is defended. The routes into it are assumed.

Most data centre risk is not about the building. It is about the standing paths that make remote operation convenient.

Management plane

Out-of-band management

IPMI, BMC and console access are permanently reachable and often the least monitored plane in the estate.

Provider access

Remote hands

Provider staff can physically touch equipment on request, with the record held by the provider.

Cross-connects

Shared fabric

Cross-connects, shared switching and provider services create routes you did not design.

Replication

Backup and replication links

Replication paths between sites stay open continuously, so an attack propagates with the data.

Lifecycle

Hardware lifecycle

Decommissioned disks and appliances leave the floor holding data that was never accounted for.

Shared space

Multi-tenant assumptions

Controls that hold in a private facility do not always hold where other tenants share the same space.

Why the exposure exists

Remote operation was the requirement.

Colocation exists so that people do not have to travel. Every convenience that supports that becomes a standing route.

The honest position

Contracts govern behaviour, not connectivity.

A colocation contract describes what the provider will and will not do. It does not decide which routes into your racks exist.

Control the path, protect the asset.

Management planes are built for accessOut-of-band exists so equipment can be reached when everything else has failed.
Provider boundaries are unclearResponsibility is split, so neither party holds a complete list of the routes into the racks.
Replication is always-on by designContinuous replication is treated as resilience, even though it copies the incident as faithfully as the data.
Audits look at the facilityCertifications cover the building and process, not the specific connections your estate depends on.

Which paths need controlling

Write down every route into the racks.

Data centre exposure becomes manageable the moment the routes are named rather than assumed. Switch between today and with Control.

Out-of-band management

Who uses itInfrastructure team

How it behaves todayAlways reachableWhat Control governsWindow opened for named maintenance, then closed
Provider remote hands

Who uses itFacility staff

How it behaves todayOn request, provider-loggedWhat Control governsApproved, time-bound and evidenced on your side too
Cross-connects and shared fabric

Who uses itProvider and partners

How it behaves todayPersistentWhat Control governsDocumented crossings with physical enforcement
Replication to second site

Who uses itPlatform team

How it behaves todayContinuousWhat Control governsScheduled transfer with a disconnected gold copy
Vendor maintenance

Who uses itHardware suppliers

How it behaves todayStanding accountsWhat Control governsValidated request, opened window, automatic close

This is a list a provider cannot write for you. It describes your estate, not their facility.

What physical Control changes

Routes into the floor exist only when they are needed.

Physical Control sits in the path itself, so a management plane or cross-connect is not simply firewalled. It is absent between windows.

Today

Convenience routes

Every convenience route is available at all times.

Out-of-band reachable continuously
Provider access governed by contract only
Replication open around the clock
Evidence held mainly by the provider

With Control

Governed routes

Routes are opened deliberately and close on their own.

Management access exists only inside a maintenance window
Every crossing named, approved and recorded
A gold copy held physically disconnected
Your own evidence trail, independent of the provider

If the route is not there, neither the provider nor an attacker can use it.Connected when approved. Disconnected by default.

The Control philosophy

Control the path, protect the asset.

Control is physical, or it is only a policy. Software can be told to deny a connection. Physical Control removes the connection itself, so the denial does not depend on the system behaving as configured.

1
Start with the path, not the tool

Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.
2
Make the default state disconnected

A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.
3
Open on approval, close on schedule

When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.
4
Prove it physically, not on paper

A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.

NeedSets the direction
ControlSets the rule
BlueprintSets the architecture
Modules and Firebreak®Implement it

Where this goes next

The Blueprint for this need is CP-04 Enforce Physical Segmentation.

Data centre and colocation exposure spans two patterns: enforcing the boundary between zones, and keeping critical systems available while disconnected from unnecessary routes.

CP-04 Enforce Physical Segmentation

Segmentation should not just be logical. It should be physically enforceable. Segmentation should not just be logical. It should be physically enforceable.

Open Blueprint CP-04 Compare all Blueprints

What the Blueprint adds

It shows how zones are separated in hardware rather than in configuration
It sets out maintenance and vendor windows that open and close on purpose
It defines the evidence you hold yourself, independent of the facility provider

Also relevant: CP-05 Protect Critical Infrastructure

Keep critical systems available, controlled and disconnected from unnecessary exposure.

Open CP-05

Vault product icon A different job

Holding a recovery copy that no route can reach is a different job. Offline Secure Storage keeps a disconnected gold copy outside the facility’s connected estate.

Hold a disconnected gold copy

Lead module

FV-Firebreak

Physically opens or closes connection paths to prevent unauthorised access and stop attack progression.

Read FV-Firebreak

Lead module

FV-Isolate

Separates systems and networks into controlled zones to reduce lateral movement and enforce trust boundaries.

Read FV-Isolate

Lead module

FV-Unlink

Removes persistent connections, live dependencies and inherited trust that keep sensitive assets exposed.

Read FV-Unlink

Questions

What teams ask about data centres

No. Access is still remote. It exists inside a window opened for a named person and purpose, rather than continuously.

Certifications cover the building and process, not the specific connections your estate depends on. Control gives you your own evidence trail, independent of the provider.

Management access opens inside a window for a named person and purpose, approved and recorded, rather than being reachable continuously.

Yes. Replication to a second site becomes a scheduled transfer, with a gold copy held physically disconnected, rather than a path that stays open around the clock.

All questions

List the routes into the floor. Then govern them.

CP-04 Enforce Physical Segmentation and CP-05 Protect Critical Infrastructure set out how those routes are separated, opened and evidenced.

Open Blueprint CP-04 Talk to a member of the team

Open CP-04 What changes

You own the racks. You rarely own every route into them.

The estate is defended. The routes into it are assumed.

Out-of-band management

Remote hands

Shared fabric

Backup and replication links

Hardware lifecycle

Multi-tenant assumptions

Remote operation was the requirement.

Contracts govern behaviour, not connectivity.

Write down every route into the racks.

Out-of-band management

Provider remote hands

Cross-connects and shared fabric

Replication to second site

Vendor maintenance

Routes into the floor exist only when they are needed.

Convenience routes

Governed routes

Control the path, protect the asset.

Start with the path, not the tool

Make the default state disconnected

Open on approval, close on schedule

Prove it physically, not on paper

The Blueprint for this need is CP-04 Enforce Physical Segmentation.

FV-Firebreak

FV-Isolate

FV-Unlink

What teams ask about data centres

List the routes into the floor. Then govern them.