Do not forget physical security (including, but not limited to, access control & surveillance -- different logs, videos, and people to control), local/municipal/state laws and regulations (e.g. fire control standards), personnel to manage all that sites (even third-party)... IMHO too much administrative burden. 
AbraƧos,
Marlon Borba, CISSP, APC DataCenter Associate
TĆ©cnico JudiciĆ”rio - SeguranƧa da InformaĆ§Ć£o
TRF 3 RegiĆ£o
(11) 3012-1683