Data Centre Security Closeout: What Keeps Holdback Moving

You are a few weeks from turnover on a data room or edge site. The security sub says they are nearly done, but the owner’s IT team has not seen a device list, two doors still do not release on the fire alarm test, and nobody knows whose name the video software licence is in. Small items like these are what keep a job open.

The short answer: write the security closeout list into the subcontract at award, collect it as the work goes in, and test against it before anyone asks for substantial performance. Security is often one of the last trades to finish on a data centre, because it needs doors, power, the network and the owner’s people to be ready first. Ontario’s 2026 holdback changes make a clean finish worth more than it used to be.

What changed with holdback this year?

Holdback now moves every year as well as at the end. Under amendments that took effect January 1, 2026, owners must release holdback after each contract anniversary unless a lien prevents it, according to the Ontario Association of Architects’ practice tip on holdback release, updated in February 2026. The owner publishes a notice within 14 days of the anniversary and pays the accrued holdback 60 to 74 days after that notice. Contracts signed before 2026 get a transition period, so many existing jobs see their first annual release in 2027.

On a multi-year data centre build, that helps cash flow. Each annual payment also reduces the holdback still retained, but whatever remains at the end still waits for lien periods to run after the job is finished. The Council of Ontario Construction Associations’ fact sheet on annual release suggests subcontractors ask the contractor for the prime contract’s anniversary date at the outset. Give it to your security sub at kickoff and save everyone a phone call later.

How can a short security punch list hold up the end of the job?

It can stop the contract from counting as finished. The OAA practice tip explains that a contract is “deemed completed” when the price of completing the work, correcting known defects or making the last supply is no more than the lesser of 1 per cent of the contract price and $5,000. On any contract over $500,000, $5,000 is the smaller number. A few doors that still will not release, cameras not yet aimed and an operations team not yet trained can be enough to stay above that line.

The same list matters if you go the substantial performance route. When a payment certifier decides whether a contract is substantially performed, the OAA recommends keeping a calculation of the known incomplete work and deficiencies, ideally item by item. Open security items sit on that list next to everyone else’s. The OAA also notes that a contractor’s 60-day lien period runs from the earlier of publication of the certificate of substantial performance or the contract being completed, abandoned or terminated. Until one of those happens, the clock that releases the remaining holdback has not started.

What should the security closeout package contain?

Everything the owner needs to run, service and prove the system without phoning the installer. Put this list in the subcontract and ask for drafts well before the last site visit.

• As-built drawings showing every camera, reader, door contact, panel, power supply and cable route as installed, including field changes.
• A device schedule listing each device with its location, model, network address and the name it carries in the software, so drawings, labels and screens all match.
• Signed test records for every door and camera, with who witnessed each test. Our acceptance testing plan covers what a fair test looks like.
• Fire alarm interface results for doors designed to release on alarm, tested together with the fire alarm contractor and written down.
• Cable test results for every structured cabling run the security sub installed.
• Software licences, configuration backups and administrator accounts registered to the owner and handed over securely, never printed in the O&M binder.
• O&M manuals, warranty start dates and any spare parts the specification calls for.
• Training sign-off with names and dates.
• A current WSIB clearance and any statutory declarations your contract requires.

The last item is easy to overlook on a long job. The WSIB’s clearance policy for construction says a clearance must be in place before construction work begins and stay in effect for the whole time the contractor is working, and that starting without one is an offence for both parties. A clearance is valid for up to 90 days and is renewable. A security sub still commissioning months after rough-in may need a fresh one, and you need to keep clearance records for at least three years.

Who owns the items that usually stall?

Often nobody, which is why they stall. Most late security items sit between two or three trades. Settle these at kickoff and record the answers in the coordination minutes.

Item	Usually waits on	Decide at kickoff
Electrified door hardware	Hardware supplier, electrical contractor, fire alarm contractor, security sub	Who supplies it, who brings power to the door, who wires the release, who witnesses the test
Network for cameras and controllers	Owner IT or network integrator	When the IP address list and switch ports are ready, and who provides power over Ethernet
Power to security panels	Electrical contractor	Which circuits feed them, labelled on the drawings
Licences and admin accounts	Owner	Whose name licences are registered in and who receives the credentials
Training and witnessed tests	Owner’s operations team	Dates booked before substantial performance is requested

Give the network row extra time on a data centre. Owners there often have firm rules about what connects to their network, and cameras cannot be aimed or recording verified until ports and addresses exist. If the security sub is also running the cabling, our networking and data wiring page explains how that scope fits.

Outdoor devices belong in the same conversation. On the newly built Toronto data centre Securitron completed this year, the scope included pole-mounted dome cameras over the electrical switchgear yard and a camera on a rooftop mast, along with interior cameras, cabling and a wall-mounted network cabinet. Devices like the yard and roof cameras typically depend on other trades for bases, conduit, power and roof access, and each of those hand-offs can land on the punch list if nobody owns it.

Can the security sub’s holdback be released early?

Sometimes, but plan on the normal route. Ontario’s Construction Act allows a subcontract to be certified complete, and once the lien period for that subcontract has passed without liens, the holdback for that trade can be released. The OAA notes this mechanism is meant for trades that finish well before substantial performance, such as excavation and foundations. Certification is optional, and the payment certifier needs enough documentation to confirm the subcontract is totally complete, including a declaration of last supply and WSIB paperwork.

A security sub rarely finishes early on a data centre, since its testing, programming and training run to the end. Treat early certification as a bonus. The realistic goal is a security closeout that is complete when the rest of the job is, so it is never the item standing between you and the certificate.

What should you ask a security sub before award?

Ask to see a closeout package from a past job with client details removed. Ask how they track field changes for the as-builts, who on their team owns commissioning, how they hand over passwords and licences, and how they keep their WSIB clearance current. Their answers tell you more about your last month on site than their unit prices do. Our bid comparison scorecard has more questions for the buyout meeting.

If you are pricing or running a data centre, edge site or server room job in the GTA, send us the drawings and the security specification. We will review the scope and the closeout list with you before award. More on that work is on our data centres page.