Chain of custody in a data center relocation is the continuous, signed record of every server, storage device and network component from de-installation at the origin to installation at the destination: who handled it, when, where and in what condition. It is how you prove that nothing was lost, swapped or accessed while it was out of your control.
What does chain of custody mean in a data center relocation?
Every piece of equipment that leaves your facility is potential exposure to a data breach, theft or tampering. Chain of custody means knowing exactly where every server, storage device and piece of network equipment is at any moment of the move, and being able to prove it afterwards.
A relocation is harder than a single shipment for three reasons. The asset count runs to hundreds or thousands of items, so small error rates produce real losses. The move usually happens in waves over several days or weekends, with several trucks and crews, so there are many more handoffs. And drives, media and small components are often pulled from chassis and travel separately, which multiplies the number of items that need their own record.
The answer is to treat custody as a system designed before the first cable is unplugged: one inventory, one set of identifiers, defined checkpoints and a signature at every one of them.
How should assets be inventoried and tagged before the move?
Inventory everything before it leaves the floor, and give each asset an identifier that will be scanned at every checkpoint. Barcodes or RFID tags both work; what matters is that every handoff is a scan rather than a guess. The inventory should capture:
- Serial numbers and asset tags
- Physical condition, with photographs
- Configuration states and connection maps
- Data classification levels
Reconcile the inventory against your CMDB first. Discrepancies found at the origin dock are easy to resolve; discrepancies found at the destination start an investigation. Reconciling the CMDB against physical inventory covers the method, and asset tagging and labeling standards covers labels that survive handling.
Tie each asset to its move wave and truck in the inventory, so the manifest for any single load can be printed and checked on its own.
How should drives and storage media be packed and sealed?
Equipment that holds sensitive data travels in locked containers with tamper-evident seals, and every seal number is recorded and checked at each handoff.
- Hard drives and storage arrays stay in locked containers or locked transport cases
- Seal numbers go on the manifest and are verified at every transfer point
- Drives pulled from chassis get container-level manifests listing each serial
- GPS-enabled containers are worth considering for high-value or high-sensitivity equipment
Record your IT team's attestation of each drive's state before packing: client-encrypted, wiped (by your team or a licensed contractor) or scheduled for drive destruction. The logistics team records that attestation; it does not check encryption and has no access to your systems. Tamper-evident seals and GPS tracking explains how the two controls complement each other.
NIST SP 800-53 control MP-5, media transport, maps onto these steps: protect media in transit, keep accountability, restrict handlers.
Who should be allowed to handle the equipment?
Only people who have been vetted, identified and recorded. Every person who touches your equipment should appear in the custody file. That includes:
- Background-checked relocation specialists
- Security escorts for sensitive equipment transfers
- Documented handoff procedures with signatures at each transfer point
- Photo identification checks at loading and unloading
Keep the crew list fixed for each wave where you can. Late substitutions are a common source of unsigned handoffs, because the substitute was never added to the access list or briefed on the procedure. Badge lists, escort rules and dock hours at both sites must match the move schedule. Crew vetting and site access requirements lists what facilities typically ask for and how far in advance.
How is equipment tracked between the two sites?
With GPS on transport vehicles, scans at every checkpoint and, for sensitive loads, a security escort. Together they give you continuous visibility of where your assets are.
- GPS tracking on each vehicle shows location and route throughout the trip
- RFID or barcode scanning at checkpoints confirms counts and serials at every handoff
- Security escorts in a separate vehicle keep high-value loads under 24/7 physical surveillance in transit
- Secure communication channels between origin, vehicle and destination teams let everyone know when a load departs, stops or arrives
Plan the route as part of the custody design: no unplanned stops, no overnight parking in unsecured lots, and a defined procedure if a vehicle breaks down. Security escorts for high-value IT shipments covers when an escort is warranted and what it should document.
Which regulations require custody records during a relocation?
Several industries have specific requirements for maintaining chain of custody when equipment moves. The table summarizes the common ones.
| Industry | Framework | What it means for the move |
|---|---|---|
| Healthcare | HIPAA | Documented handling of systems holding health data; 45 CFR 164.310 calls for a record of hardware and media movements; escorts may be needed |
| Financial services | PCI DSS, SOX | Payment and financial systems need tamper-evident transport logs and verified personnel; standards at the PCI Security Standards Council |
| Government and defense | FedRAMP, ITAR | Cleared personnel and secure transport vehicles are often required |
| Law enforcement | CJIS | Personnel screening and escort rules for criminal justice systems |
Confirm requirements with your compliance team before planning, because they decide crew composition and vehicle choice. See cleared facilities for government and defense moves and CJIS-compliant IT equipment relocation.
What documents should a relocation custody file contain?
Six records, kept for every asset and every wave:
- Pre-move asset inventory with condition reports
- Loading manifests with signatures
- Transport logs with route tracking
- Checkpoint verification records
- Unloading confirmation with condition comparison
- Final installation verification
Each document should reference the same asset identifiers, so an auditor can follow one serial number from the origin rack to the destination rack without translating between systems. Store it with the project records, not on a crew tablet.
The final installation record closes the chain: the asset is in its planned rack position, the person who installed it has signed, and your team has accepted it. Audit-ready documentation for infrastructure moves shows how to organize the file.
What should you look for in a relocation partner's custody process?
A partner whose custody process you can inspect before you sign. The right logistics partner understands these requirements and has systems in place to maintain chain of custody throughout your move. Look for:
- Background-checked personnel
- Tracking and reporting throughout transit
- Tamper-evident packaging and sealing protocols
- Documented handoff procedures
- Insurance and liability coverage appropriate for your equipment value
Ask for a sample custody record from a previous move, redacted, and walk through it. Gaps in the sample will be gaps in yours. Evaluating a data center relocation company covers the wider selection process.
Put these protocols in place before the first piece of equipment is unplugged, and you protect your organization from breaches and compliance findings throughout the move.