For what it is worth, whenever I need to refer to the practice of hosting servers in a datacenter, I’ll talk about “colocation” which means that I want to locate something with something else. Alas, this term is new to our language, and isn’t in the dictionary.

There is a different word in the dictionary, collocation, which according to Wikipedia “is defined as a sequence of words or terms which co-occur more often than would be expected by chance.”

Alas, many times I have seen people run “colocation” through a spell checker and blindly accept that “collocation” is the correct spelling. I do not hold such people in high esteem.

Cheers,
-danny

My experience has been it’s hard to work with the facilities directly as a small customer. Although in the past this was trying to get 1/4 and 1/2 racks. Maybe a full cabinet is easier? At any rate, staying where we’re at for now is our best option. Decoupling the IP-space move from the new install and the fast turnaround (we’re moving in today, 4 days after signing) are both working for us.

@David M – The Visa CISP list has a whopping total of 4 colocation providers. Only one of them is local (Datapipes, AFAIK) and they are full. Not many options there.

We asked everyone if they were either PCI DSS or SAS-70 certified. Here’s the problem: very few data centers want to be SAS-70 because it costs hundreds of thousands of dollars (their words, not mine). Many of these facilities have been audited by a customer for their PCI efforts but none of the above providers had been certified themselves. Thus, the certification belongs to the customer and is beyond our use. We did speak with a couple of SAS-70 certified people in SF and Oakland but their pricing was, surprise!, much higher.

We chose to go the locking cabinet route vs. an open rack specifically for this reason. Combined with facility security, restricting cabinet access to the keyholders (us) will let us satisfy the PCI requirements. Having the facility audited for our own needs is beyond our price/scope at this point (we’re level 3).

If you are strict colocation, you still should be placing your servers in a data center which has been assessed for PCI Compliance.

If you are looking for managed services, again, you should be looking for a hosting provider which has been assessd for PCI Compliance.

By placing you servers in a data center which has been assessed for PCI, you are able to kick of a number of line items on the PCI DSS Standard. Further, one of the recommendations under PCI is to use PCI Compliant vendors.

David Mertz
Compliance Security Partners
816 256-2125
dave@csp-mw.com

529 Bryant
11 Great Oaks
200 Paul
185 Barry
etc…

Most of the providers listed above are just middle men, charing up rates.

-David