Where data sensitivity or other security requirements rule out sharing equipment or racks with other tenants, an isolated area segregates the application owner's servers, network gear, storage, power feed and cabling, is clearly identified, is away from common areas such as corridors and main exits, and is open only to authorised persons with every physical access approved and recorded by the data centre manager. Access to the isolated area runs through an electronic access control system or equivalent, the area stays locked even when attended, dual control governs authorisation and approval including additions to and removals from the standing access list (which the application owner or another authorised person approves), every need-based access is approved and recorded, and the area access logs and the standing list are reviewed regularly, for example quarterly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.