# Physical Security and Environmental Controls

> Chapter 15 of the Courseiva CASP-PLUS curriculum — https://courseiva.com/learn/casp-plus/physical-security-and-environmental-controls

**Official objective:** 4.4 — Implement physical security controls, environmental monitoring, and facility access management.

## Introduction

An organisation can have the world's strongest firewall and the most advanced encryption, but if an intruder can walk into a server room and unplug a cable, or if a burst pipe floods the data centre, all that digital security means nothing. Physical security and environmental controls are the foundation that every other cybersecurity measure sits on, and the CAS-005 exam will test your ability to make smart decisions about doors, cameras, cooling systems, and power backups — not just software.

## The Museum Curator Analogy

A museum curator is responsible for protecting priceless artefacts and ensuring the building remains a safe environment for both the collection and visitors. They do not just lock the front door at night. They install motion sensors in every gallery, use reinforced glass for display cases, and keep climate control systems running constantly to stop humidity from cracking ancient pottery. They also set up fire suppression systems that use gas instead of water, because water would ruin a 500-year-old painting. 

 Every day, the curator checks logs from the security cameras, reviews who badged into the storage vault, and makes sure the backup generator is fuelled and ready. If a pipe bursts in the basement, alarms alert the facilities team before the water reaches the main hall. The curator also practises emergency drills with staff, so everyone knows exactly where to go if a fire alarm sounds. 

 In cybersecurity, an IT professional does the same work for servers, networking equipment, and data centres. The artefacts are the organisation's data and hardware. The museum's climate control maps to environmental monitoring. The badge-access system maps to facility access management. The fire suppression system maps to physical security controls. Every lock, sensor, and procedure that protects the museum has a direct counterpart in the IT world, and forgetting any one of them can lead to a total loss of the collection.

## Core explanation

Physical security controls are the barriers and procedures that keep unauthorised people away from sensitive equipment and data. Environmental controls are the systems that keep the equipment running at the right temperature, humidity, and power levels. Facility access management is the process of deciding who gets in, when, and how. 

 Let us start with physical security controls. The most obvious is the lock. A simple key lock works, but it has a major weakness: keys can be copied and lost. Modern data centres use electronic locks, often controlled by a badge reader or a keypad. When an employee swipes their badge, the system logs the time, the door, and the identity of the person. This creates an audit trail — a record of who entered and when. You might also see biometric locks, which use a fingerprint, iris scan, or facial recognition. Biometrics are harder to fake than a badge, but they have privacy concerns and can fail if the sensor gets dirty. 

 Another layer is the mantraps. A mantrap is a small room with two doors. You enter through the first door, it locks behind you, and then you must authenticate (with a badge or pin) to open the second door. If you do not have the right credentials, you are trapped inside. This prevents tailgating, which is when an unauthorised person follows an authorised person through a door without using their own credentials. 

 CCTV (closed-circuit television) cameras are everywhere in secure areas. They do not stop an intruder on their own, but they act as a deterrent and provide evidence after an incident. Modern systems use video analytics that can detect motion, recognise faces, or even identify abandoned objects. The footage is usually stored for a set period, like 30 or 90 days, and then overwritten. 

 Now let us talk about environmental controls. Computer equipment generates a lot of heat. Without cooling, a server room can reach temperatures that cause components to fail. Air conditioning units designed for data centres (often called CRAC units — Computer Room Air Conditioning) maintain a consistent temperature, usually between 18-27 degrees Celsius. Humidity is also critical. Too much humidity causes condensation, which can short-circuit electronics. Too little humidity causes static electricity, which can destroy sensitive components. Humidifiers and dehumidifiers keep the relative humidity in a safe range, typically 40-60%. 

 Power is another environmental factor. Utility power can fail or fluctuate. An uninterruptible power supply (UPS) is a battery system that gives servers enough time to shut down cleanly or to switch over to a backup generator. A UPS typically provides 5-30 minutes of power. A generator, often diesel-powered, can run for days or weeks as long as fuel is supplied. Data centres also use power distribution units (PDUs) to distribute electricity to racks of equipment. 

 Fire suppression in a data centre is different from a home sprinkler system. Water sprinklers can destroy electronics. Instead, data centres use gas-based suppression systems, such as FM-200 or Novec 1230. These gases displace oxygen in the room, starving the fire without damaging the equipment. When the system activates, an alarm sounds to warn any people inside to evacuate immediately, because breathing in that atmosphere is dangerous. 

 Facility access management ties everything together. It is not just about having a badge system — it is about defining who should have access to which areas. The principle of least privilege applies just as much to physical spaces as it does to computer systems. A junior technician does not need access to the core network switch room. A contractor should only be allowed into the lobby, not the server floor. Access lists are reviewed regularly, and badges are deactivated when an employee leaves the company. 

 Finally, consider environmental monitoring. Sensors placed throughout the facility measure temperature, humidity, water leaks, and smoke. These sensors send alerts to the facilities team or to a central monitoring station. If a water pipe bursts under the raised floor of a data centre, a water leak sensor can trigger an alarm within seconds, giving staff time to shut off the water and move equipment before catastrophic damage occurs.

## Real-world context

An IT professional, often called a data centre operations manager or a facilities administrator, is responsible for implementing and maintaining all of these controls. Let us walk through a typical day. 

 At 8am, the IT lead receives an automated alert from the environmental monitoring system. The temperature in rack 17 has risen to 30 degrees Celsius, above the safe threshold. The lead checks the dashboard to see which CRAC unit is underperforming. They find that the cooling coil in unit 4 has frozen. They put in a work order for the HVAC maintenance team and temporarily reroute cooling from a neighbouring unit to keep rack 17 within spec. 

 At 9:30am, a new employee arrives for their first day. The IT lead has already set up their badge access in the facility management system. The employee will only have access to the office floor and the break room — not to the server room or the network closet. The lead walks the employee through the tailgating policy and shows them how to use the mantrap to enter the secure area. 

 At 11am, a security guard calls because a badge swipe at the back loading dock was recorded at 2am, but no one was scheduled to be on site. The IT lead reviews the CCTV footage and sees an unauthorised person following a courier into the building. The lead immediately revokes the courier's temporary badge access and initiates a security review. 

 At 2pm, the IT lead performs a quarterly audit of the access control list. They export the list of all active badges and compare it to the current employee roster. They find three ex-employees whose badges were never deactivated. They disable those badges immediately and flag the HR process for follow-up. 

 At 4pm, the lead tests the UPS and backup generator. They simulate a power failure by flipping the main breaker. The UPS kicks in instantly. The lead monitors the server load over the next 10 minutes, then starts the generator. The generator runs smoothly for 30 minutes before they switch back to mains power. This test is done quarterly to ensure the equipment will work during a real outage. 

 At 5:30pm, the lead reviews the fire suppression system maintenance log. The gas cylinders for the FM-200 system need to be refilled. They schedule a certified technician to perform the service next week, and they ensure the system is placed in maintenance mode so it does not accidentally discharge while being serviced.

## Exam focus

The CAS-005 exam tests your practical knowledge of implementing physical security and environmental controls. You will not be asked to memorise specific product models, but you will need to know the purpose and trade-offs of each control type. 

 Expect multiple-choice questions that present a scenario and ask you to select the best control. For example, a question might describe a company worried about tailgating and ask which control to implement. The correct answer is usually a mantrap. Another common scenario involves a data centre in a humid climate — the best environmental control is a dehumidifier. 

 The exam loves to test the difference between a UPS and a generator. A common trap is to choose a UPS when the scenario needs long-term backup power. Remember: a UPS provides immediate, short-term power (battery), while a generator provides long-term power (fuel). 

 Another frequent topic is fire suppression. The exam wants you to know that water-based sprinklers are not used in server rooms because they damage equipment. The correct choice is a gas-based system like FM-200 or inert gas. Also watch for questions about pre-action sprinklers — these are a hybrid that only release water after a smoke detector triggers, which reduces accidental activation. 

 They also test the principle of least privilege as it applies to physical access. A scenario might describe a contractor who needs to install a server. The correct answer is to grant them access only to the specific rack and only for the duration of the job, using a temporary badge with restricted hours. 

 Environmental monitoring questions often revolve around detecting water leaks, smoke, and temperature changes. You need to know that sensors are placed under raised floors (for water) and in hot aisles (for temperature). The exam may ask about SNMP (Simple Network Management Protocol) traps — these are alerts sent from sensors to a central management console. 

 Traps to watch out for: 
- Confusing access control with authentication. A badge is an access control mechanism, but it must be paired with a policy (least privilege) to be effective. 
- Assuming biometrics are always better than badges. Biometrics can have higher failure rates and privacy implications. 
- Thinking that CCTV alone is sufficient. Detection without a response does not prevent a breach. 
- Forgetting that fire suppression systems can harm people — the exam expects you to know about the evacuation alarm and the danger of oxygen displacement. 

 Key definitions to memorise: 
- Mantrap: a small room with two interlocking doors to prevent tailgating. 
- UPS: battery-based short-term backup power. 
- Generator: fuel-based long-term backup power. 
- PDU: power distribution unit, manages power to multiple devices in a rack. 
- CRAC: computer room air conditioning, maintains temperature and humidity. 
- FM-200: a clean agent fire suppressant that does not damage electronics.

## Step by step

1. **Assess Risks** — Identify the physical threats to the facility: unauthorised entry, theft, fire, flood, power failure, extreme temperature, and humidity. For each threat, determine the likelihood and potential impact on equipment and data.
2. **Design Layered Access Control** — Define concentric security zones: perimeter fence, building lobby, department floor, server room, and individual racks. For each zone, choose controls: fences, locks, badge readers, biometrics, and mantraps. Ensure each zone requires different credentials.
3. **Implement Environmental Monitoring** — Install sensors for temperature, humidity, water leaks, and smoke in all critical areas, especially under raised floors and in hot aisles. Connect sensors to a monitoring system that sends alerts to the facilities team via email, SMS, or SNMP traps.
4. **Deploy Power Redundancy** — Install UPS units for each rack to provide immediate battery backup. Connect the UPS to an automatic transfer switch that triggers a diesel generator when utility power fails for more than a few seconds. Test the entire chain quarterly.
5. **Install Fire Suppression** — Choose a clean agent gas suppression system (FM-200, Novec 1230, or inert gas) for the server room. Install smoke detectors that activate both the gas discharge and an audible evacuation alarm. Place warning signs outside doors to prevent entry during discharge.
6. **Establish Access Policies and Auditing** — Write a policy that defines who gets access to which zone, how badges are requested and approved, and the process for disabling badges upon employee departure. Conduct quarterly audits by comparing the badge list to the current HR roster, and revoke any outdated access.
7. **Test and Maintain** — Quarterly, test all systems: simulate a power failure to verify UPS and generator handoff, practise an evacuation drill, test the fire suppression system (in maintenance mode), and review CCTV footage for any suspicious activity. Document all tests and fix any failures within a week.

## Comparisons

### UPS (Uninterruptible Power Supply) vs Generator

**UPS (Uninterruptible Power Supply):**
- Provides instant battery power (milliseconds to start)
- Runs for 5-30 minutes depending on battery capacity
- Handles short outages and bridges the gap until a generator starts

**Generator:**
- Takes several seconds to start and reach stable power
- Runs for days or weeks as long as fuel is supplied
- Handles long-term outages, requires fuel storage and regular maintenance

### Mantrap vs CCTV Camera

**Mantrap:**
- Prevents tailgating by physically trapping unauthorised people
- Requires authentication to pass through both doors
- Active control: stops an incident from happening

**CCTV Camera:**
- Records events but does not physically stop entry
- Provides evidence after an incident, no authentication required
- Passive control: only detects and documents, does not prevent

### Gas-Based Fire Suppression vs Water-Based Sprinkler System

**Gas-Based Fire Suppression:**
- Uses clean agents (FM-200, Novec 1230) that do not damage electronics
- Displaces oxygen to extinguish fire, requires evacuation before discharge
- Higher installation cost and requires periodic refilling of gas cylinders

**Water-Based Sprinkler System:**
- Uses water, which destroys electronic equipment instantly
- Cools the fire with water, can be activated by heat or smoke
- Lower installation cost, but causes massive water damage to equipment

### Biometric Lock vs Badge Reader

**Biometric Lock:**
- Uses unique physical traits (fingerprint, iris) — hard to forge
- Cannot be revoked if the biometric data is compromised; cannot change your fingerprint
- Higher false rejection rate — can lock out authorised users if sensor is dirty or worn

**Badge Reader:**
- Uses a card or fob that can be easily replaced if lost
- Badges can be immediately deactivated and reissued
- Lower false rejection rate, but badges can be borrowed or stolen

### CRAC Unit (Computer Room Air Conditioning) vs Standard Office Air Conditioner

**CRAC Unit (Computer Room Air Conditioning):**
- Designed to run 24/7 with high reliability and precise temperature control (18-27°C)
- Includes humidity control (dehumidifier/humidifier) to maintain 40-60% relative humidity
- Often placed under a raised floor to cool hot aisles directly in front of server racks

**Standard Office Air Conditioner:**
- Designed for intermittent use and human comfort (20-23°C)
- Does not manage humidity precisely — allows wide swings that damage electronics
- Mounted on walls or ceilings, not designed for concentrated heat loads from servers

## Diagram

_Layers of physical security and environmental controls from the building perimeter to individual server racks, showing how access and environmental systems work together in a typical data centre._

```mermaid
flowchart TD
    A[Facility Perimeter] --> B[Fence and Gate]
    B --> C[Lobby with Guard]
    C --> D[Mantrap with Badge Reader]
    D --> E[Server Room Door with Biometric Lock]
    E --> F[Individual Server Racks with Locks]
    F --> G[Cooling: CRAC Units]
    F --> H[Power: UPS and Generator]
    F --> I[Fire Suppression: Gas System]
    F --> J[Environmental Sensors: Temp, Humidity, Water Leak]
```

## Common misconceptions

- **Misconception:** A fire sprinkler system is the best choice for a server room because it is the most effective at putting out fires. **Reality:** Water sprinklers destroy electronic equipment. Server rooms use gas-based suppression systems (like FM-200) that put out fires without damaging hardware. (People assume fire suppression is universal. In everyday life, water is the default, so beginners do not realise that protecting equipment from water damage is a higher priority than using the most aggressive firefighting method.)
- **Misconception:** If you have CCTV cameras everywhere, you do not need badge access control on every door. **Reality:** Cameras record events but do not prevent access. Without electronic locks and badge systems, anyone can open the door, and CCTV is only useful after the fact for investigation. (Beginners often think surveillance equals security. They do not distinguish between detection (seeing what happened) and prevention (stopping it from happening). The exam expects you to know that controls work in layers.)
- **Misconception:** A UPS and a generator serve the same purpose, so you only need one of them. **Reality:** A UPS provides instant battery power for a short time (5-30 minutes) to cover the gap until a generator starts. A generator provides long-term power but takes several seconds to kick in. Both are required for full protection. (People see both as 'power backup' and assume they are redundant. They do not understand the different response times and roles. Exam questions specifically test this distinction.)
- **Misconception:** Biometric locks are always more secure than badge readers, so you should use them everywhere. **Reality:** Biometrics have a higher false rejection rate (lockout) and cannot be revoked if compromised (you cannot change your fingerprint). Badge access is much easier to manage and revoke. Biometrics are best for high-security areas only. (Beginners think 'more advanced = more secure'. They overlook practical issues like failure rates and revocability. The exam tests this balance between security and usability.)
- **Misconception:** Environmental monitoring is just about keeping the room at a comfortable temperature for people. **Reality:** Environmental monitoring focuses on equipment requirements: temperature (18-27°C), humidity (40-60%), water leaks, and smoke. People comfort is secondary. The goal is to prevent hardware failure. (In everyday life, we think of temperature control as personal comfort. Beginners forget that servers generate heat and are damaged by humidity. The exam expects you to know the specific ranges and sensors used.)

## Key takeaways

- Physical security controls, such as mantraps and badge readers, prevent unauthorised physical access to sensitive areas and are the foundation of all other security measures.
- Environmental controls, including dedicated cooling (CRAC), humidity management, and fire suppression (gas-based), protect hardware from heat, moisture, and fire damage.
- A UPS provides instant short-term battery backup, while a generator supplies long-term fuel-based power; both are required for comprehensive power protection.
- The principle of least privilege applies to physical access: grant only the minimum access needed for a person's role, and deactivate badges immediately when someone leaves the organisation.
- Water-based fire sprinklers destroy electronics, so data centres use clean agent gas suppression systems like FM-200 that extinguish fires without harming equipment.
- Environmental monitoring sensors for temperature, humidity, water leaks, and smoke are placed under raised floors and in hot aisles, and they send alerts via SNMP to a central management console.
- Tailgating is prevented by mantraps — a small room with two interlocking doors that trap unauthorised people who try to follow an authorised person through.
- CCTV provides detection and evidence, but it does not prevent access; it must be paired with access control systems and a response procedure to be effective.

## FAQ

**What is the difference between a UPS and a generator?**

A UPS (uninterruptible power supply) provides instant battery power for a short time (5-30 minutes) to bridge the gap until a generator starts. A generator runs on fuel (usually diesel) and provides power for days or weeks, but takes several seconds to start, so you need both.

**Why can't you use water sprinklers in a server room?**

Water destroys electronic equipment immediately. Server rooms use gas-based suppression systems (like FM-200 or Novec 1230) that displace oxygen to extinguish the fire without harming the hardware.

**What is a mantrap and how does it work?**

A mantrap is a small room with two doors. You enter through the first door, it locks behind you, and then you must authenticate (with a badge or pin) to open the second door. It prevents an unauthorised person from following you in — a tactic called tailgating.

**How often should I audit physical access badges?**

Industry best practise is to audit the badge access list at least quarterly. You compare the list of active badges to the current employee roster and deactivate any badges belonging to people who have left, transferred, or no longer need access.

**What is the ideal temperature and humidity for a data centre?**

The ideal temperature for a server room is between 18 and 27 degrees Celsius. The ideal relative humidity is between 40% and 60%. Outside this range, equipment can overheat, suffer from static discharge, or be damaged by condensation.

**What does SNMP mean in the context of environmental monitoring?**

SNMP stands for Simple Network Management Protocol. It is a standard protocol that sensors (temperature, humidity, water leak) use to send alerts to a central monitoring console. An IT administrator can configure the console to send emails or SMS when a sensor reading goes outside the safe range.

## Check your understanding

1. **Which physical control specifically prevents an unauthorised person from following an authorised person through a door without using their own credentials?**

   Answer: A mantrap — a small room with two interlocking doors that requires separate authentication for each door, trapping anyone who attempts tailgating.

2. **What is the primary reason water-based fire sprinklers should not be used in a server room?**

   Answer: Water instantly destroys electronic equipment, causing more damage than the fire itself. Server rooms use gas-based suppression (like FM-200) that extinguish fire without harming hardware.

3. **What is the difference in role between a UPS and a generator during a power outage?**

   Answer: A UPS provides instant battery power for a short duration (5-30 minutes) to bridge the time until a generator starts. A generator then supplies long-term power from fuel for as long as needed.

4. **What is the ideal relative humidity range for a data centre, and why does it matter?**

   Answer: The ideal range is 40-60% relative humidity. Below 40%, static electricity can damage components; above 60%, condensation forms and can short-circuit electronics.

5. **Name two sensors used in environmental monitoring and what they detect.**

   Answer: A temperature sensor detects heat levels in server racks. A water leak sensor, placed under raised floors, detects the presence of water from a burst pipe or flooding.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/casp-plus/physical-security-and-environmental-controls