Physical Security and Environmental Controls

Physical security controls are the barriers and procedures that keep unauthorised people away from sensitive equipment and data. Environmental controls are the systems that keep the equipment running at the right temperature, humidity, and power levels. Facility access management is the process of deciding who gets in, when, and how.

Let us start with physical security controls. The most obvious is the lock. A simple key lock works, but it has a major weakness: keys can be copied and lost. Modern data centres use electronic locks, often controlled by a badge reader or a keypad. When an employee swipes their badge, the system logs the time, the door, and the identity of the person. This creates an audit trail — a record of who entered and when. You might also see biometric locks, which use a fingerprint, iris scan, or facial recognition. Biometrics are harder to fake than a badge, but they have privacy concerns and can fail if the sensor gets dirty.

Another layer is the mantraps. A mantrap is a small room with two doors. You enter through the first door, it locks behind you, and then you must authenticate (with a badge or pin) to open the second door. If you do not have the right credentials, you are trapped inside. This prevents tailgating, which is when an unauthorised person follows an authorised person through a door without using their own credentials.

CCTV (closed-circuit television) cameras are everywhere in secure areas. They do not stop an intruder on their own, but they act as a deterrent and provide evidence after an incident. Modern systems use video analytics that can detect motion, recognise faces, or even identify abandoned objects. The footage is usually stored for a set period, like 30 or 90 days, and then overwritten.

Now let us talk about environmental controls. Computer equipment generates a lot of heat. Without cooling, a server room can reach temperatures that cause components to fail. Air conditioning units designed for data centres (often called CRAC units — Computer Room Air Conditioning) maintain a consistent temperature, usually between 18-27 degrees Celsius. Humidity is also critical. Too much humidity causes condensation, which can short-circuit electronics. Too little humidity causes static electricity, which can destroy sensitive components. Humidifiers and dehumidifiers keep the relative humidity in a safe range, typically 40-60%.

Power is another environmental factor. Utility power can fail or fluctuate. An uninterruptible power supply (UPS) is a battery system that gives servers enough time to shut down cleanly or to switch over to a backup generator. A UPS typically provides 5-30 minutes of power. A generator, often diesel-powered, can run for days or weeks as long as fuel is supplied. Data centres also use power distribution units (PDUs) to distribute electricity to racks of equipment.

Fire suppression in a data centre is different from a home sprinkler system. Water sprinklers can destroy electronics. Instead, data centres use gas-based suppression systems, such as FM-200 or Novec 1230. These gases displace oxygen in the room, starving the fire without damaging the equipment. When the system activates, an alarm sounds to warn any people inside to evacuate immediately, because breathing in that atmosphere is dangerous.

Facility access management ties everything together. It is not just about having a badge system — it is about defining who should have access to which areas. The principle of least privilege applies just as much to physical spaces as it does to computer systems. A junior technician does not need access to the core network switch room. A contractor should only be allowed into the lobby, not the server floor. Access lists are reviewed regularly, and badges are deactivated when an employee leaves the company.

Finally, consider environmental monitoring. Sensors placed throughout the facility measure temperature, humidity, water leaks, and smoke. These sensors send alerts to the facilities team or to a central monitoring station. If a water pipe bursts under the raised floor of a data centre, a water leak sensor can trigger an alarm within seconds, giving staff time to shut off the water and move equipment before catastrophic damage occurs.

An IT professional, often called a data centre operations manager or a facilities administrator, is responsible for implementing and maintaining all of these controls. Let us walk through a typical day.

At 8am, the IT lead receives an automated alert from the environmental monitoring system. The temperature in rack 17 has risen to 30 degrees Celsius, above the safe threshold. The lead checks the dashboard to see which CRAC unit is underperforming. They find that the cooling coil in unit 4 has frozen. They put in a work order for the HVAC maintenance team and temporarily reroute cooling from a neighbouring unit to keep rack 17 within spec.

At 9:30am, a new employee arrives for their first day. The IT lead has already set up their badge access in the facility management system. The employee will only have access to the office floor and the break room — not to the server room or the network closet. The lead walks the employee through the tailgating policy and shows them how to use the mantrap to enter the secure area.

At 11am, a security guard calls because a badge swipe at the back loading dock was recorded at 2am, but no one was scheduled to be on site. The IT lead reviews the CCTV footage and sees an unauthorised person following a courier into the building. The lead immediately revokes the courier's temporary badge access and initiates a security review.

At 2pm, the IT lead performs a quarterly audit of the access control list. They export the list of all active badges and compare it to the current employee roster. They find three ex-employees whose badges were never deactivated. They disable those badges immediately and flag the HR process for follow-up.

At 4pm, the lead tests the UPS and backup generator. They simulate a power failure by flipping the main breaker. The UPS kicks in instantly. The lead monitors the server load over the next 10 minutes, then starts the generator. The generator runs smoothly for 30 minutes before they switch back to mains power. This test is done quarterly to ensure the equipment will work during a real outage.

At 5:30pm, the lead reviews the fire suppression system maintenance log. The gas cylinders for the FM-200 system need to be refilled. They schedule a certified technician to perform the service next week, and they ensure the system is placed in maintenance mode so it does not accidentally discharge while being serviced.