CoreSite Successfully Completes Annual Compliance Examinations

DENVER–(BUSINESS WIRE)–CoreSite Realty Corporation (NYSE:COR), a premier provider of secure,
reliable, high-performance data
center and interconnection
solutions across the U.S., today announced it has successfully completed
its annual compliance examinations for the colocation services offered
across 17 operating multi-tenant data centers in its portfolio. The
completion of these annual examinations uniquely positions CoreSite to
provide its customers a consistent and comprehensive solution to
compliance standards as part of its overall customer value proposition.
The completion of these various compliance objectives also demonstrates
CoreSite’s ongoing commitment to operational excellence and customer
experience, enabling its more than 1,350 customers to meet industry
standard compliance requirements. In addition to enterprise-class
colocation infrastructure, CoreSite provides controls over physical
access and environmental systems that house its customers’ critical data
systems and hardware. CoreSite successfully completed the following
annual examinations:

• System and Organization Controls (SOC) 2 Type 2 examination
• SOC 1 Type 2 examination
• International Organization for Standardization (ISO) Information
  Security Management System (ISMS) certification (ISO 27001)
• Payment Card Industry (PCI) Data Security Standard (DSS) validation
• Health Insurance Portability and Accountability Act (HIPAA) attestation

The SOC 1 and SOC 2 examinations are attestation standards issued by the
American Institute of Certified Public Accountants (AICPA), and both
reports have been issued under Statement on Standards for Attestation
Engagements (SSAE) No. 18, which is the new AICPA standard for SOC
reports. SOC 2 is measured using a standardized set of criteria,
requirements, and controls; whereas, SOC 1 is measured against
company-defined control objectives and underlying controls. The
examinations provide CoreSite customers with the assurance of corporate
controls, including controls relating to physical and environmental
security, customer support, and operational excellence. Companies with
compliance requirements may require SOC 1 or SOC 2 examination reports,
including publicly traded enterprises, financial firms, and healthcare
organizations.

ISO 27001 is an internationally recognized standard that outlines the
requirements for constructing a risk-based framework to initiate,
implement, maintain, and manage information security within an
organization. The ISO 27001 certification, one of the most stringent
certifications for information security controls, confirms that
specified information security controls and other forms of risk
treatment are in place to detect and defend against potential
information security threats and vulnerabilities. The certification also
ensures that the information security controls continue to meet physical
security needs on an ongoing basis. The scope of the ISO 27001
certification is applicable to the information security management
system (ISMS) supporting CoreSite’s provision and operation of 24×7
colocation services for its customers, and covers both its corporate
policies and procedures as well as those of its operating data centers.

The PCI-DSS is a broad set of standards that require merchants and
service providers that maintain or host systems that store, process, or
transmit customer payment card data to adhere to strict information
security controls and processes. As a provider of data center colocation
services, CoreSite has proactively met the relevant requirements for its
business in support of the PCI compliance needs of its customers. The
2017 PCI-DSS report has been issued under version 3.2.

HIPAA requires that covered entities and business associates take strong
measures to protect the privacy and security of protected health
information. By attaining an attestation against the HIPAA Security
Standards for the Protection of Electronic Protected Health Information
(“HIPAA Security Rule”) and the Notification in the Case of Breach of
Unsecured Protected Health Information enacted as part of the American
Recovery and Reinvestment Act of 2009 (“HITECH Breach Notification
Requirements”), CoreSite provides assurance to healthcare industry
stakeholders that its data center colocation services meet the HIPAA
Security Rule and HITECH Breach Notification requirements necessary to
protect a covered entity’s physically hosted information systems in
CoreSite’s national platform of multi-tenant data centers.

All of the above examinations and assessments were conducted by
Schellman & Company, LLC, an independent CPA and Qualified Security
Assessor (QSA) firm.

About CoreSite

CoreSite Realty Corporation (NYSE:COR) delivers secure, reliable,
high-performance data center and interconnection solutions to a growing
customer ecosystem across eight key North American markets. More than
1,350 of the world’s leading enterprises, network operators, cloud
providers, and supporting service providers choose CoreSite to connect,
protect and optimize their performance-sensitive data, applications and
computing workloads. Our scalable, flexible solutions and 450+ dedicated
employees consistently deliver unmatched data center options — all of
which leads to a best-in-class customer experience and lasting
relationships. For more information, visit www.CoreSite.com.

Forward-Looking Statements

This press release may contain forward-looking statements within the
meaning of the federal securities laws. Forward-looking statements
relate to expectations, beliefs, projections, future plans and
strategies, anticipated events or trends and similar expressions
concerning matters that are not historical facts. In some cases, you can
identify forward-looking statements by the use of forward-looking
terminology such as “believes,” “expects,” “may,” “will,” “should,”
“seeks,” “approximately,” “intends,” “plans,” “pro forma,” “estimates”
or “anticipates” or the negative of these words and phrases or similar
words or phrases that are predictions of or indicate future events or
trends and that do not relate solely to historical matters.
Forward-looking statements involve known and unknown risks,
uncertainties, assumptions and contingencies, many of which are beyond
CoreSite’s control that may cause actual results to differ significantly
from those expressed in any forward-looking statement. These risks
include, without limitation: any adverse developments in local economic
conditions or the demand for data center space in these markets;
operational difficulties, including difficulties relating to information
systems, internal processes and information security; significant
industry competition; financial market fluctuations; and other factors
affecting the real estate industry generally. All forward-looking
statements reflect CoreSite’s good faith beliefs, assumptions and
expectations, but they are not guarantees of future performance.
Furthermore, CoreSite disclaims any obligation to publicly update or
revise any forward-looking statement to reflect changes in underlying
assumptions or factors, of new information, data or methods, future
events or other changes. For a further discussion of these and other
factors that could cause CoreSite’s future results to differ materially
from any forward-looking statements, see the section entitled “Risk
Factors” in CoreSite’s most recent annual report on Form 10-K, and other
risks described in documents subsequently filed by CoreSite from time to
time with the Securities and Exchange Commission.