When we used Iron Mountain at my last job, there were two interesting additional concerns:

1) That nobody in our company actually knew where they were physically stored (insider risk?), but

2) That we had assurance that the physical storage was far enough away that a physical disaster in our area wouldn't also touch where the offline storage was located.

There's a concomitant jump in RTO if that's what you do this, but hopefully that's well understood among the stakeholders.