What are the best practices for physical security in datacenters?

Physical security protects your datacenter from unauthorized access, theft, vandalism, and natural disasters. Here are the practices that matter:

1. Site Selection

Pick a location outside flood zones, earthquake faults, and other natural disaster risks.
Avoid highly visible or easily accessible sites that draw unwanted attention.

2. Perimeter Security

Install fencing that defines a clear boundary.
Place bollards or concrete barriers to stop vehicle attacks.
Light the exterior well enough to deter intruders and let guards see clearly.

3. Access Control

Limit entry points so you can monitor them effectively.
Require multi-factor authentication: key cards, PINs, biometrics (fingerprint, facial recognition, iris).
Log every visitor with a management system, not just a paper book.
Use mantraps — two sequential locked doors — so only one authenticated person enters at a time.

4. Surveillance

Cover all entry points, hallways, server rooms, and critical areas with high-resolution cameras.
Monitor feeds 24/7, either by trained staff or automated alerts.
Retain footage securely for a defined period; know your legal and operational requirements.

5. On-Site Security Personnel

Hire trained guards for monitoring and rapid response.
Schedule patrols inside and outside the facility on a random but frequent basis.
Make sure every guard knows the incident response plan cold.

6. Internal Physical Barriers

Restrict server room access to authorized personnel only, using the same access control as the perimeter.
Lock server racks to prevent hardware tampering.
Secure cable runs so they can’t be pulled or cut accidentally or maliciously.

7. Environmental Controls

Install fire detection and clean-agent suppression (e.g., FM-200, Novec 1230) — water sprinklers destroy gear.
Keep temperature and humidity in the ASHRAE recommended ranges; monitor continuously.
Use raised floors and proper drainage to handle leaks or flooding.

8. Redundant Infrastructure

Back every power path with UPS and generators; test transfer switches monthly.
Run diverse network paths from different providers or POPs.

9. Auditing and Monitoring

Log every access event — badge swipes, biometric reads, mantrap cycles — and keep logs tamper-proof.
Run internal security audits quarterly; bring in a third party annually.
Do physical penetration tests: try to tailgate, bypass mantraps, pick locks, clone badges.

10. Policies and Procedures

Write clear policies for access provisioning, revocation, visitor escort, and incident escalation.
Train all staff — not just security — on tailgating awareness, badge hygiene, and emergency procedures.
Run background checks on anyone with unescorted access to critical areas.

11. Emergency Preparedness

Maintain a tested disaster recovery plan with defined RTO/RPO for physical incidents.
Mark emergency exits clearly; equip them with crash bars and alarms that alert security when opened.
Run drills for fire, intrusion, and natural disasters at least twice a year.