The Witness Nobody Names: Attesting Remote-Hands Work Inside the Colocation Cage

At two in the morning in a Slough colocation hall, a remote-hands technician swaps a failed transceiver, reseats a fibre patch and closes the ticket. The service desk records the incident as resolved. The monitoring graph flattens back to green. What the record does not show is who authorised the swap, which port was touched, whether the spare was genuine, whether the old optic left the building in a sealed bag, or whether anybody on your side verified the link before the ticket was signed off. For a UK technology leader accountable to a regulator, an auditor or a board, "the provider confirmed it" is not a control statement. It is an assertion, and assertions do not survive scrutiny.

The problem is structural. Physical-layer work inside a third-party facility is the least instrumented part of most estates. It happens on someone else's premises, under someone else's shift pattern, using someone else's tooling and access cards. The provider's ticket system is designed to manage their workload, not to produce evidence that satisfies your resilience obligations. If you cannot reconstruct an intervention after the fact, you cannot defend the estate that depended on it.

Where the evidence trail usually breaks

Most organisations can produce a ticket number and a timestamp. Far fewer can produce an instruction record that names the requester, the asset, the permitted action and the point at which that permission expired. Custody of hardware is typically informal: a spare arrives, a failed part leaves, and nobody signs for either. Photographic evidence, when it exists, is a single snapshot taken at an unhelpful angle with no asset label in frame. Console sessions may be logged by the provider, but the export is rarely requested, hashed or retained. Verification is assumed rather than performed, because the link came up and the alert cleared.

Each of these gaps is individually minor. Together they mean an intervention has occurred inside your recovery boundary with no attributable record. The British Standard for business continuity and the NCSC's supply chain guidance both point in the same direction: you are accountable for the controls operated on your behalf, not merely for the ones you run yourself. The same logic underpins the evidence expectations now placed on UK financial entities and their critical third parties.

Authorisation boundaries: instruction, scope and the right to refuse

Remote-hands work should begin with an instruction record, not a phone call. A workable record carries four fields: the identity of the requester, the asset identifier, the specific action permitted, and an expiry. Anything outside those four fields is a new instruction. Standard moves, adds and changes can be pre-approved within a defined catalogue; anything else requires a change record and a named approver.

The boundary must include the right to refuse. A remote-hands team asked to pull a cable from a port that does not match the instruction should stop, not improvise. That refusal needs to be explicitly authorised in the contract, because the commercial incentive for a provider is to be helpful. Helpfulness without scope is how undocumented change enters an estate.

Custody for hardware and media

Every component that crosses the facility boundary should be treated as an evidence item. Record the serial number, photograph the seal at receipt, photograph the installed part with its asset label visible, and record the disposition of the failed unit — returned, retained or destroyed, with the identity of whoever witnessed it. Data-bearing media deserves more: drives, tapes and any device that has held production data should follow a documented destruction or return path, with a certificate that satisfies UK GDPR obligations and the expectations of the Information Commissioner's Office.

Photographic and console evidence as a defined set

Photographs should form a specified set rather than an opportunistic snapshot: before, during and after, with the asset label and a timestamp visible in each frame. Ask for the image files, not screenshots pasted into a ticket, and retain them alongside the instruction record.

Where an intervention touches configuration rather than cabling, the strongest evidence is the out-of-band console session. Request the session export from the baseboard management controller, record its hash at receipt, and store it with the change record. A hashed console log does two things a photograph cannot: it shows the commands that were run, and it proves the record has not been altered since it was handed over.

Verification belongs to you, not the provider

Acceptance criteria should be agreed before work starts. Verification after the event should be performed from your side of the boundary: link state, interface counters, configuration drift against the last known baseline, and a monitoring window long enough for intermittent faults to surface. Twenty-four to seventy-two hours is a reasonable default for network and storage changes. The provider confirming that the port is up is not verification; it is the start of it.

Escalation triggers

Some findings should stop work and escalate immediately: an asset that does not match the instruction, unexpected firmware on a replacement part, evidence of prior undocumented work in the same cage, a request that drifts beyond scope, or any safety concern. These triggers should be written into the contract and into the provider's runbook, not left to the judgement of an individual technician at three in the morning.

A minimum viable attestation pack

For each intervention, retain:

• the instruction record, with requester, asset, action and expiry;
• evidence of approval against the change process;
• the custody form, with serials and witness identity;
• the before, during and after photographic set;
• the hashed console session export, where configuration was touched;
• the verification results, with the monitoring window stated;
• a sign-off by a named individual on your side.

The pack should be assembled within an agreed period after the intervention — five business days is achievable and defensible — and retained in line with your sector's record-keeping obligations.

Contract terms that make attestation possible

None of this works unless the agreement supports it. You need a right to audit, a defined evidence delivery service level, a specified format, a camera policy that permits photographic records, access to out-of-band management, named contacts for escalation, and a clear statement that undocumented work will be refused. These are not unusual clauses; they are simply frequently omitted.

The question for the board

Can you prove who touched your estate last quarter, what they did, and that the change held? If the answer depends on the provider's goodwill rather than your own records, resilience is being asserted rather than evidenced. The work is invisible by design. The evidence does not have to be.