Key takeaways
- Physical security works in layers, from the property line to the rack, so one failed control does not expose the equipment.
- Most real-world failures are procedural: tailgating, unescorted visitors, stale access lists, and propped doors.
- SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, and NIST SP 800-53 all include physical controls, and auditors expect records that prove those controls operate.
- Data centers also carry environmental obligations for refrigerants, generators, and fuel storage, and security must never block emergency egress.
Defense in depth: six layers
No single lock, guard, or camera is enough. Data centers stack controls so an intruder has to defeat several independent barriers, and each layer is a chance to detect them. A typical layout:
- PerimeterFencing, gates, bollards, and setbacks that keep vehicles and people at a distance.
- SiteGuarded entry, vehicle inspection, lighting, and cameras covering parking and the loading dock.
- BuildingA staffed lobby, ID checks, badge readers, and hardened walls with few entry points.
- Data hallMantraps, multi-factor access, and cameras on every entry and aisle.
- Cage or suiteCustomer-specific access lists, locked cage doors, and separate badge zones.
- RackLocked cabinet doors with keys, combination locks, or electronic handles that log each opening.
The deeper you go, the fewer people should have access and the stronger the authentication should be. A delivery driver might reach the dock, a contractor the electrical room, and only a customer's named staff their cage.
Access control
Credentials: something you have, know, and are
Most sites issue badges (smart cards or proximity cards) and add a second factor at sensitive doors: a PIN or a biometric such as fingerprint, hand geometry, iris, or face recognition. Older low-frequency proximity cards are easy to clone, so many operators have moved to encrypted smart card credentials. Every reader event goes to the access control system, which records who, where, when, and whether access was granted.
Tailgating is the most common way past a badge reader. See anti-tailgating in access control for mantraps, portals, and anti-passback, and data center security guards for the officer side of access control.
Mantraps and anti-tailgating
Tailgating (following someone through a door) is the most common way physical controls fail, usually through politeness rather than malice. Mantraps, also called security vestibules, use two interlocked doors so the inner one will not open until the outer one has closed, often with sensors that detect more than one person. Optical turnstiles and anti-passback rules, which refuse a badge that was never logged in, close other gaps. Controls only work if they are tested; see how security leads run anti-tailgating drills.
Two-person rules and access reviews
High-risk areas and tasks, such as media destruction rooms, key cabinets, or a customer's cage holding regulated data, often require two-person integrity: two authorized people present, or two credentials presented, before access is granted. Just as important is keeping access lists current. Remove access the same day someone leaves or changes roles, and run periodic access reviews, commonly quarterly, where each area owner confirms every name on the list. Stale access is one of the findings auditors raise most often. The Access Control & Physical Security course covers system design and administration.
Visitor and contractor management
Visitors and contractors are where security, safety, and operations meet. A sound process looks like this:
- Pre-registration by an authorized sponsor, with the purpose, areas, and dates of the visit.
- Identity verification against a government-issued photo ID at the lobby.
- Visibly different badges that expire automatically at the end of the visit or work window.
- Escorting for anyone without unescorted access, for the entire time they are in controlled areas.
- Sign-in and sign-out records that tie each visitor to a host and, for contractors, to an approved work order or method of procedure.
- Inspection of tools, bags, and equipment coming in and going out.
Long-term contractors are a special risk because they often hold badges for months. Tie their access to a contract end date and review it with the same rigor as staff access. See how to audit contractor access controls.
Video surveillance and retention
Cameras deter, detect, and document. Coverage should include perimeter and gates, building entrances, the loading dock, lobbies, mantraps, data hall entries, aisles, and cage doors. Cameras at access points should capture a usable view of faces, not just tops of heads.
Retention is set by policy, contracts, and frameworks. PCI DSS, for example, calls for video or access control data covering sensitive areas to be kept for at least three months unless the law restricts it. Whatever period you choose, verify the recorders actually hold it at the current camera count and resolution, monitor camera health so a dead camera is noticed in hours rather than weeks, and integrate video with access control so a forced-door alarm pops up the matching footage. Organizations that do federal work should also check the procurement restrictions on certain video surveillance manufacturers under Section 889 of the FY2019 National Defense Authorization Act.
Guards and security operations
Most large sites run a staffed security operations center around the clock. Officers monitor alarms and video, staff the lobby, patrol on a logged guard tour, process visitors, and respond to events such as a door forced open, a door held open, or a badge used at an unexpected hour. Written post orders tell each officer exactly what that post does, and incident reports record every event. Security also works closely with the facilities team and the network operations center: a door alarm at 3 a.m. may be an intruder, or it may be an engineer responding to a chiller alarm.
Asset, key, and media handling
Assets are tagged and tracked from the loading dock to the rack and back out. Deliveries go to a controlled receiving area, and anything leaving the building needs a property pass that matches serial numbers to an authorized request.
Keys still matter in a badge-controlled building: rack keys, cage keys, electrical room keys, and override keys for electronic locks. Store them in a controlled key cabinet that logs who took each key, use restricted keyways that cannot be copied at a hardware store, and audit the key inventory on a schedule.
Media such as failed drives and decommissioned servers can hold sensitive data long after they stop working. Keep them in locked containers with a chain-of-custody record, and sanitize or destroy them following NIST SP 800-88, which describes clearing, purging, and destroying media. Physical destruction methods include shredding, crushing, and degaussing for magnetic media. Get a certificate of destruction listing serial numbers, and reconcile it against your inventory. Many customers require destruction on site, witnessed by their own staff.
Compliance frameworks that reach into the building
Most data center compliance work maps physical controls to one or more of these frameworks. A colocation provider may be audited against several at once on behalf of its customers.
| Framework | Physical requirements | What auditors look for on site |
|---|---|---|
| SOC 2 | AICPA Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). The common criteria include restricting physical access to facilities and protected assets. | Access lists matched to HR records, access review sign-offs, visitor logs, and working mantraps and cameras during a walkthrough. |
| ISO/IEC 27001:2022 | Annex A physical controls (A.7.1 to A.7.14) cover perimeters, entry, monitoring, utilities, cabling, equipment maintenance, and secure disposal. | Controls traced to the risk assessment and Statement of Applicability, plus evidence the controls run as documented. |
| PCI DSS Requirement 9 | Restrict physical access to cardholder data: entry controls, visitor management, monitoring of sensitive areas, and media handling and destruction. | Camera or access data retained at least three months, distinct visitor badges, visitor logs, and media inventories. |
| HIPAA Security Rule, 45 CFR 164.310 | Physical safeguards: facility access controls, workstation use and security, and device and media controls. | A facility security plan, maintenance records for doors and locks, and media disposal and re-use records. |
| NIST SP 800-53 PE family | Physical and environmental protection controls, including access authorizations, visitor records, emergency shutoff, emergency power, fire protection, and environmental controls. | Authorization lists, monitoring logs, and test records for power, fire, and environmental systems. |
Notice how far these reach beyond locks. ISO/IEC 27001 and NIST SP 800-53 both cover supporting utilities and environmental protection, so a generator test log or a temperature trend can become audit evidence. Our Security & Compliance for Data Centers course maps these frameworks to day-to-day facility work.
Audit evidence: proving controls work
Auditors test controls by sampling records, so a control that is not documented effectively did not happen. Keep these organized and easy to retrieve:
- Access control logs and alarm histories, with exports you can filter by date, door, and person.
- Badge issuance and termination records, matched to HR start and end dates.
- Signed access reviews for each controlled area.
- Visitor and contractor logs with sponsors and escorts.
- Video retention settings and evidence that footage is retrievable.
- Drill and test records: anti-tailgating tests, evacuation drills, alarm response tests.
- Training records for security officers and staff with physical access.
- Maintenance and inspection records for security, fire, and power systems.
On the walkthrough, auditors watch behavior as much as paperwork: whether people hold doors, whether visitors wear badges, whether media sits unattended. See what to organize before an ISO 27001 audit.
Ready to check your knowledge? Questions on access control, frameworks, and audit evidence.
Take the Security QuizEnvironmental compliance basics
Data centers hold refrigerant, burn diesel, and store fuel, which brings environmental rules that facility teams own. The common ones in the United States:
- Refrigerants (EPA Section 608). The Clean Air Act requires certified technicians, proper recovery, and, for larger appliances, leak inspection, repair, and recordkeeping. Rules under the AIM Act add requirements for HFC systems, so confirm current EPA requirements. Keep service records, refrigerant added and recovered, and technician certifications.
- Generator air permits. Diesel standby generators are stationary engines regulated under federal emissions rules and usually a state or local air permit. Emergency engines are limited in how many hours they may run for testing and maintenance, so accurate run-hour logs and fuel records matter.
- SPCC plans (40 CFR 112). Facilities with more than 1,320 gallons of aboveground oil storage capacity (counting containers of 55 gallons or more) that could reasonably discharge to navigable waters need a Spill Prevention, Control, and Countermeasure plan. Generator day tanks and bulk diesel tanks often trigger it. Expect secondary containment, inspections, a five-year plan review, and annual discharge prevention briefings for oil-handling staff.
- Stormwater. Construction that disturbs one acre or more needs NPDES construction stormwater coverage, and operating sites may have stormwater conditions tied to fuel deliveries and outdoor equipment under state rules.
Spent batteries, used oil, and coolant also need proper waste handling. The Facility Environmental Compliance course covers these programs.
Fire and life safety interfaces
Security and life safety pull in opposite directions: security wants doors locked, and fire codes want people out fast. Building and fire codes require that locked doors still allow free egress in an emergency. In practice, that means:
- Electrified locks on egress paths release on fire alarm or loss of power, where the code requires it, and delayed egress hardware is used only where the code allows.
- Mantraps have a defined emergency egress mode that does not trap anyone.
- Fire department access is planned, often with a key box at the entrance.
- Security officers have a role in evacuation, headcounts, and meeting responders.
- Officers understand clean agent pre-discharge alarms and EPO stations, because they are often first on scene.
Coordinate any change to access control hardware with the fire alarm designer and the authority having jurisdiction. The Data Center Safety Guide covers suppression systems and EPO in depth.
Courses that go deeper
These self-paced courses cover physical security, compliance frameworks, and environmental programs, and each awards a certificate of completion.
Security & Compliance for Data Centers
Build a facility security program that satisfies SOC 2, ISO 27001, and physical audit requirements.
Access Control & Physical Security
Practical security training for facility staff — access control, surveillance, and incident reporting.
Data Center Physical Security and Access Control Training
Foundational physical security and access control practices for data hall environments.
Facility Environmental Compliance
Understand the environmental regulations that apply to your facility.
Data Center Fire Suppression System Safety Training (Clean Agent Systems)
Clean agent fire suppression safety for occupied data hall environments.
Save 42% with the bundle
Security & Compliance Bundle
Frequently asked questions
What is a mantrap in a data center?
A mantrap, also called a security vestibule or portal, is a small space between two interlocked doors. The second door will not open until the first has closed, and many mantraps use sensors to confirm only one person is inside. It stops tailgating, where an unauthorized person follows an authorized one through a door.
What is the difference between a SOC 2 Type 1 and Type 2 report?
A Type 1 report describes the controls and whether they were suitably designed at a single point in time. A Type 2 report also tests whether the controls operated effectively over a period, often six to twelve months. Customers of colocation and cloud providers usually ask for the Type 2 report because it shows the controls actually worked.
How long should data center video footage be kept?
It depends on the frameworks and contracts that apply. PCI DSS calls for video or access control data covering sensitive areas to be kept for at least three months unless the law restricts it, and many customer contracts set their own minimums. Set a written retention period that meets the strictest requirement you are under, then confirm the recording system actually keeps that much.
Who needs EPA Section 608 certification at a data center?
Any technician who maintains, services, repairs, or disposes of equipment in a way that could release refrigerant, such as opening a CRAC unit or chiller circuit, needs Section 608 certification from an EPA-approved certifying program. Facility managers do not need it to oversee the work, but they should keep copies of contractor certifications and service records.
Keep learning
Standards & Regulations
How TIA-942, NFPA, OSHA, ASHRAE, and ISO fit together.
Read the guide → GuideOperations & Maintenance
Shifts, procedures, change control, and the records auditors sample.
Read the guide → CareersData Center Security Officer
What the role involves and how to prepare for it.
See the role → CareersCompliance Specialist
The people who keep audits on track and evidence in order.
See the role →This guide is general educational information, not legal, compliance, or engineering advice. Requirements depend on your contracts, the frameworks you are audited against, and the laws and codes in your jurisdiction.