Introduction

The Payment Card Industry Data Security Standard (PCI DSS) imposes strict security obligations on organizations that handle cardholder data. In a colocation environment, responsibilities can blur as clients rely on a data center’s physical security but handle their own systems. This article clarifies which tasks typically rest with the data center, which fall to the client, and how to structure contracts for PCI DSS compliance.

Shared Responsibility Model

Facility Controls: Physical security, power redundancy, and cooling typically belong to the colocation provider. PCI DSS mandates secure access points and visitor logs, among other controls.

Tenant Systems: Rack-level security, firewalls, and data encryption remain the tenant’s domain. Clients also manage PCI scope, such as restricting who can access cardholder data.

Key Contractual Clauses

Attestation of Compliance (AOC): A colocation provider may offer an AOC demonstrating their adherence to physical security controls. Clients should confirm the scope covers relevant PCI requirements.

Incident Response: Contracts should specify how a provider notifies tenants about breaches—especially if the environment is multi-tenant. Rapid notification helps clients meet PCI’s tight reporting windows.

Audit & Inspection Rights

On-Site Assessments: PCI DSS requires annual inspections. Clients may request the right to conduct or review these audits. Providers often prefer to share independent auditor reports instead of multiple client-run audits.

Liability Allocations: If a colocation provider fails a security audit, tenants may seek service credits or the right to terminate. Providers typically cap liability through well-crafted SLA limitations.

Conclusion

Achieving PCI DSS compliance in a colocation environment involves clear lines of responsibility between the data center operator and its tenants. By articulating these in a detailed contract—and ensuring each party meets their obligations—both sides can avoid compliance gaps that invite steep fines or reputational damage.

For more details, please visit www.imperialdatacenter.com/disclaimer.