Data Centre Security Guide: Physical and Access Controls

Every logical control in a data centre can be bypassed by someone who reaches the hardware, cuts the power or lets the room overheat. Data centre security is the combination of physical access control, environmental protection (power, cooling, fire and water) and the management systems that run both, from badge readers to baseboard management controllers. This guide covers layered physical zoning, access control and visitor management, environmental controls with real thresholds, resilience tiers, the facility's own attack surface, colocation and hyperscale shared responsibility, and how the controls map to ISO/IEC 27001:2022 Annex A 7, NIST SP 800-53 PE and EN 50600-2-5. It is written for security architects, facilities and data centre managers, and auditors who assess owned, colocated or outsourced facilities. General site security (offices, reception, tailgating awareness) is covered in the Physical Security Guide for Security Teams and is not repeated here.

Key takeaways

Design in concentric zones. Each step from the site boundary to the rack should add a control, and the number of people authorised should drop at every step.
Environmental failure is a security event. NIST SP 800-53 treats power, fire, temperature and water (PE-9 to PE-15) as security controls, and outages are as damaging as intrusions.
The facility has its own attack surface. Access control servers, building management systems and server BMCs are networked, credentialed and exploited; CISA lists an AMI MegaRAC BMC authentication bypass (CVE-2024-54085) as known exploited.
Know which standard says what. ISO/IEC 27001 Annex A 7 and SP 800-53 PE say what to control; EN 50600-2-5 defines protection classes for spaces; Uptime Institute Tiers describe power and cooling redundancy, not security.
Outsourcing moves the work, not the accountability. In colocation and cloud, verify the provider's controls through assurance reports and contracts, and keep control of your own cage, keys, media and staff access lists.

Where data centre security starts and ends

Most organisations now run a mix of owned server rooms, colocation cages, hyperscale cloud regions and edge sites. The physical controls differ in who operates them, not in what they must achieve.

Model	Who runs physical and environmental controls	What you still own	How you get assurance
Owned data centre or server room	You	Everything, from perimeter to disposal	Internal audit, ISO/IEC 27001 certification scope
Colocation (cage, suite or rack)	Provider for site, power, cooling and fire; you for cage and racks	Authorised access list, cage locks or readers, rack-level controls, your hardware and media, remote hands instructions	Provider certifications and audit reports, site visits, access logs for your space
Hyperscale cloud (IaaS, PaaS, SaaS)	Provider entirely	Logical configuration, identities, data; no physical access	Provider compliance reports under NDA; contractual commitments
Edge and branch sites	Often you, with weaker controls	Locked cabinets, tamper detection, remote monitoring, encrypted disks	Site inspections; asset tracking (PE-20)

Virtual and software-defined data centres (SDDC) do not remove physical risk; they concentrate it. One hypervisor host or storage array holds many workloads, so a stolen disk or a console session on one host can expose many systems. Logical isolation between tenants is covered in the Cloud Security Guide and Confidential Computing Guide; this guide focuses on the physical layer underneath.

Layered physical zoning

EN 50600-2-5:2021, the security systems part of the European data centre standard series, designates data centre spaces and assigns each a Protection Class for each protection aspect: unauthorised access, intrusion, fire, and internal and external environmental events. It defines four Protection Classes for access, each more restrictive than the last, and a space may sit in different classes for different aspects. A practical zoning model looks like this:

Zone	Typical spaces	Entry control	Monitoring
1. Site perimeter	Fence line, car park, loading approach	Vehicle barriers, gate control, anti-ram measures where risk justifies	CCTV with retention, perimeter intrusion detection, lighting
2. Building shell	Reception, corridors, shipping and receiving	Staffed reception, identity verification, visitor badges, mantrap or turnstile into secure areas	CCTV on all entrances, door forced and door held alarms
3. Secure areas	Data halls, meet-me rooms, network rooms	Badge plus PIN or biometric, anti-passback, individual (not shared) credentials	Access logs reviewed, CCTV of entry and aisles
4. Critical plant	UPS and battery rooms, generator, switchgear, chillers, fire suppression control	Restricted list of facilities staff and approved contractors, escorted otherwise	Building management system alarms, CCTV
5. Cage, rack and device	Customer cages, racks holding key material (HSMs, backup media)	Rack locks or rack readers, two-person rule for highest sensitivity	Rack door sensors, per-rack access logs (PE-3(1), PE-6(4))

Delivery and removal: PE-16 requires authorising and controlling components entering and exiting the facility and keeping records. Keep shipping and receiving outside secure areas and reconcile asset tags in and out; PE-3(2) adds security checks at the perimeter for removal of components.
Location of components: PE-18 asks for components to be positioned to minimise damage from physical and environmental hazards and unauthorised access: no data halls under water pipes, kitchens or roofs with plant, and no critical rooms on outside walls next to public areas.
Cabling and transmission: PE-4 and ISO/IEC 27001 Annex A 7.12 (cabling security) cover the physical protection of distribution and transmission lines: use enclosed trays or conduit for cross-connects outside secure areas, and lock meet-me rooms.

Access control, authorisation and visitors

Maintain an authorised list (PE-2): develop and approve the list of people with facility access, issue credentials, review the list at a defined frequency, and remove people when access is no longer required. Tie it to HR leaver and contractor end-date feeds rather than manual tickets.
Enforce at every door (PE-3): verify authorisation before granting access, control ingress and egress, keep physical access audit logs, escort visitors, and secure keys, combinations and other physical access devices. Inventory and change mechanical keys and combinations when they are lost or when holders leave.
Use strong credentials for secure areas: card-only access is defeated by a cloned or borrowed card. NIST SP 800-116 Rev. 1 describes a risk-based way to choose among the PIV authentication mechanisms defined in FIPS 201 for physical access control systems (PACS); the same principle applies outside government: card plus PIN or biometric for data halls, cryptographic card authentication rather than reading a static card number.
Record visitors (PE-8): keep visitor records for a defined period, review them and report anomalies. Visitors, vendors and remote hands staff should be escorted in secure areas and never issued unescorted badges for a single visit.
Review and reconcile: compare badge logs to the authorised list and to change tickets each month. Entries without a ticket, out-of-hours access and badges used at two sites in impossible time are the useful signals.

Choosing controls by size: a small organisation with one server room can meet PE-2, PE-3 and PE-8 with a locked room, an electronic lock with audit trail, a short named list and a visitor book reviewed monthly. Large or multi-tenant facilities need integrated PACS with mantraps, anti-passback, biometrics at the data hall, CCTV analytics and a security operations desk. In both cases, the authorised list is the control most often allowed to drift. See the Insider Threat Programme Guide for the people side.

Environmental controls: power, cooling, fire and water

Threat	Control	NIST SP 800-53	ISO/IEC 27001 Annex A
Mains power loss	UPS sized for orderly shutdown or transfer; generator for extended loss with tested fuel supply	PE-11, PE-11(1)	7.11 Supporting utilities
Damage to power equipment and cabling	Protected switchgear and cable routes, separate A and B feeds	PE-9	7.12 Cabling security
Need to cut power in an emergency	Emergency power-off near entrances, protected against accidental or unauthorised activation	PE-10	7.11
Loss of lighting during evacuation	Automatic emergency lighting for exits and routes	PE-12	7.5
Fire	Detection and suppression on an independent energy source; automatic notification to responders	PE-13, PE-13(1)	7.5 Protecting against physical and environmental threats
Temperature and humidity outside limits	Monitored levels with alarms on harmful change	PE-14, PE-14(2)	7.8 Equipment siting and protection
Water leakage	Accessible, working master shutoff or isolation valves known to key staff; leak detection under raised floors	PE-15	7.5

Thermal thresholds: ASHRAE TC 9.9's Thermal Guidelines for Data Processing Environments (fifth edition) give a recommended inlet envelope of 18 to 27 °C dry bulb for classes A1 to A4, with allowable ranges that widen by class (A1: 15 to 32 °C). Set alarm thresholds against the recommended envelope at server inlets, not room averages.
Redundancy levels: the Uptime Institute Tier classification describes infrastructure resilience: Tier I basic capacity, Tier II redundant capacity components, Tier III concurrently maintainable (any component can be taken out for maintenance without affecting IT), Tier IV fault tolerant (independent, physically isolated systems so a single failure does not affect IT). Tiers are progressive. They say nothing about access control or cyber security, so a Tier IV rating is not a security assurance.
Test, do not assume: run generator load tests, UPS battery tests and fire system inspections on a schedule, and record results. An untested transfer switch is the classic failure behind "redundant" sites going dark.

Facility resilience feeds directly into recovery planning: see the Business Continuity and Disaster Recovery Guide for alternate processing sites (CP-7), recovery objectives and testing, which this guide does not repeat.

The facility's own attack surface

Modern facilities are run by networked systems that attackers can reach without touching a door.

Baseboard management controllers (BMCs): out-of-band controllers (IPMI, Redfish) give power, console and firmware control of servers below the operating system. CISA added CVE-2024-54085, an authentication bypass by spoofing in AMI MegaRAC SPx BMC firmware, to the Known Exploited Vulnerabilities catalog on 25 June 2025. Put BMCs on an isolated management network, never on the internet, change default credentials, and patch BMC firmware on the same cycle as host firmware. See the Firmware and Boot Security Guide.
Building management and DCIM systems: cooling, power distribution units, UPS management cards and data centre infrastructure management (DCIM) software can shut down or overheat a hall. Treat them as operational technology: segment them, restrict remote vendor access and monitor them. See the OT Security Guide.
Physical access control and CCTV systems: the PACS server decides who opens doors and holds the audit trail. Compromise allows badge creation and log deletion. Harden it like any other privileged system, with its own admin accounts and log forwarding.
Hardware additions: MITRE ATT&CK Hardware Additions (T1200) covers devices introduced into systems or networks, such as rogue network implants or keyboard-video-mouse devices. Disable unused switch ports, use port security or 802.1X in data halls, and inspect racks after third-party work.

Where identity fits

A data centre runs on credentials that are rarely in the identity programme's scope. Badges and PINs are identities that need joiner, mover and leaver processes. BMC accounts, PDU and UPS management logins, DCIM service accounts and the integration accounts that sync HR data into the PACS are non-human identities with powerful, often shared, rarely rotated credentials. Inventory them, remove shared defaults, vault administrative passwords and include them in access reviews. Remote hands staff acting on your instructions in colocation are third-party access: define who may request work and how requests are authenticated. See the Third-Party Access Guide and the Break-Glass Account Guide for console and emergency credentials.

Equipment lifecycle, media and migration

Equipment maintenance (Annex A 7.13): maintenance by authorised staff or escorted vendors, with records; disks leaving for warranty repair should be wiped or retained (many contracts allow keeping failed drives).
Secure disposal or re-use (Annex A 7.14, MP-6): sanitise media before disposal or re-use. NIST SP 800-88 Rev. 2 (September 2025) replaced Rev. 1 as the media sanitisation guideline; use it to define a sanitisation programme with verification and certificates of destruction.
Asset tracking (PE-20, ID.AM-01): track hardware location and custody, reconcile inventory with racks at least annually, and record serial numbers of every drive.
Data centre migration and decommissioning: moves are when assets go missing. Seal and track equipment in transit, keep chain-of-custody records, sanitise before handover of vacated space, and return or destroy all badges and keys for the old site.

Implementation: a phased approach

Scope and inventory: list every site (owned, colocated, edge), its zones, the systems and data it hosts, its PACS, BMS and BMC estate, and the authorised access lists.
Assess against a baseline: use ISO/IEC 27001 Annex A 7 or the SP 800-53 PE family (selected for your impact level) and, for European facilities, the EN 50600 Protection Class model. Record gaps per zone.
Fix the authorised list first: reconcile badges to HR and contractor records, revoke orphans and shared badges, and automate removal on leaving. This is cheap and closes the commonest gap.
Isolate management networks: move BMCs, PDUs, UPS cards, BMS and PACS onto segmented networks with jump-host access; patch BMC firmware. Pilot on one row, confirm out-of-band access still works for operations, and keep the previous VLAN configuration to roll back.
Instrument the environment: deploy inlet temperature, humidity and leak sensors with alarms routed to a staffed desk; test alarm paths end to end.
Test resilience: schedule generator, UPS and fire system tests in a maintenance window with a written back-out plan, then feed results into BCDR exercises.
Contract and verify for third parties: for colocation and cloud, obtain assurance reports, set access-list and log-provision clauses, and visit colocation sites.

Detection and measurement

PE-6 requires monitoring physical access, reviewing logs at a defined frequency and on defined events, and coordinating results with incident response; PE-6(1) adds intrusion alarms and surveillance equipment. CSF 2.0 DE.CM-02 frames the same outcome: the physical environment is monitored to find potentially adverse events. Forward PACS events (door forced, door held, invalid badge, anti-passback violation), CCTV system health, BMS and environmental alarms, and BMC authentication logs to the SIEM, so physical and logical events can be correlated (a badge-in followed by console logins, or BMC logins with no matching badge-in on site).

Metric	Target
Active badges not matched to a current person or approved contractor	0, checked monthly
Time from leaving to badge deactivation	Same business day
Secure-area entries without a matching ticket or roster	Investigated within agreed time
Server inlet temperature readings outside 18 to 27 °C	Trending down; each excursion explained
BMCs reachable from user or internet-facing networks, or with default credentials	0
Generator, UPS and fire system tests completed on schedule	100%

Common failure patterns

Stale access lists: contractors and former staff keep working badges because removal depends on someone remembering to raise a ticket.
Shared badges and propped doors: a shared "engineering" badge or a door held open for deliveries makes the audit trail useless; door-held alarms are muted rather than fixed.
Management interfaces on the corporate network: BMCs, UPS cards and BMS consoles on flat networks with default passwords, reachable from any compromised laptop.
Redundancy that was never tested: a Tier III design with an untested transfer switch, an expired generator fuel contract or batteries past their life.
Remote hands without verification: a colocation provider acts on an emailed or phoned request to move cables or hand over equipment without authenticating the requester.
Drives leaving the building: failed disks returned under warranty or decommissioned servers sold without sanitisation records.

Framework mapping

Control area	ISO/IEC 27001:2022 Annex A	NIST SP 800-53 Rev. 5	NIST CSF 2.0
Perimeters, entry and secure areas	7.1, 7.2, 7.3, 7.6	PE-2, PE-3, PE-8	PR.AA-06
Physical monitoring	7.4 Physical security monitoring	PE-6, PE-6(1), PE-6(4)	DE.CM-02
Environmental threats	7.5, 7.8	PE-12, PE-13, PE-14, PE-15, PE-18	PR.IR-02
Utilities and cabling	7.11, 7.12	PE-4, PE-9, PE-10, PE-11	PR.IR-02
Equipment, media and disposal	7.9, 7.10, 7.13, 7.14	PE-16, PE-20, MP-6	ID.AM-01, PR.DS-01
Facility management systems	8.20 Networks security, 8.22 Segregation of networks	SC-7, CM-6	PR.IR-01

See the ISO 27001 Certification Guide and the NIST SP 800-53 Guide for how these families fit the wider control sets. UK operators should check whether data centre services fall in scope using the UK Cyber Security and Resilience Bill Guide.

Practitioner checklist

Map every site into zones and record the entry and monitoring control for each zone.
Reconcile the authorised access list with HR and contractor records monthly and automate badge removal on leaving.
Require badge plus PIN or biometric, with anti-passback, for data halls and critical plant.
Escort all visitors and remote hands staff in secure areas and keep visitor records under review.
Alarm inlet temperature, humidity and leak sensors to a staffed desk and test the alarm path.
Isolate BMC, PDU, UPS, BMS and PACS interfaces on management networks, remove default credentials and patch BMC firmware.
Test generators, UPS and fire systems on schedule and feed results into BCDR exercises.
Sanitise or retain every drive leaving the facility and keep certificates of sanitisation.
For colocation and cloud, obtain assurance reports and contract for access-list control and log provision.

Data Centre Security Guide: Physical, Environmental and Access Controls