Data centre security for UK facilities and server rooms

A locked server room can still be exposed through shared access, uncontrolled maintenance visits or an alarm nobody attends. Effective data centre security combines physical security for buildings and hardware with cyber protection of networks, systems and data.

The right controls depend on the consequences of loss, interference or interruption, not simply the number of racks. Assign clear ownership across security, facilities and IT before selecting equipment or setting staffing levels.

Key takeaways

• Assess credible threats, operational dependencies and recovery requirements before deciding which physical controls the facility needs.
• Separate public, staff, contractor and customer access, with permissions limited to authorised areas and approved times.
• Connect video surveillance and intrusion detection to named responders, written instructions and tested escalation arrangements.
• Protect power, cooling, communications and fire-safety systems alongside servers, storage devices and network equipment.
• Distinguish legal duties from voluntary standards, contractual requirements and recommendations that depend on the site.
• Evaluate certificates, audit reports and operating records against the actual facility and service being purchased.

Set the scope of data centre security

Physical and cyber controls protect different things

Physical security protects the facility, its equipment and the infrastructure supporting its operation. It covers intrusion, theft, sabotage, unauthorised handling, fire, flooding and interference with essential services.

Virtual security protects networks, applications, identities and information. Its controls include firewalls, intrusion detection systems, network segmentation, encryption, multi-factor authentication and role-based access control.

Security information and event management, commonly called SIEM, brings relevant system events together for investigation. Penetration testing and employee training, including phishing awareness, address weaknesses that can expose systems to cyber attacks. A fence or locked cabinet cannot resolve these risks.

The boundary between these responsibilities needs particular attention. An intruder reaching a management port may bypass network protections, whilst a compromised building-management account may disrupt cooling without anyone entering the premises.

Historical incidents also need accurate interpretation. The 2012 Global Payments data breach exposed around 1.5 million payment-card numbers, and Visa removed the processor from its compliant service-provider list. Describing that as the termination of every Visa relationship overstates what happened.

Assign owners against operational consequences

Start with the services that must remain available and the information that requires protection. Record tolerable disruption, recovery priorities and dependencies on people, suppliers and utilities.

The security manager should own access procedures and response instructions. Facilities should own the condition and operation of building services. IT should own system permissions, configuration security and disaster recovery arrangements.

Some decisions require all three. A new electronic lock can affect emergency escape, network connectivity and out-of-hours maintenance access.

Use a documented business security risk assessment to connect these responsibilities. Each significant risk should have an owner, an agreed treatment and a review point.

A small server room supporting essential clinical or industrial operations may justify stronger protection than a larger room hosting easily recoverable workloads.

Choose a site around credible hazards

Location affects both the likelihood of an incident and the ability to recover. Assess flood exposure, neighbouring activities, shared utilities, emergency access and the availability of alternative routes.

Consider river flooding, surface-water flooding and drainage failure separately. A building outside a river flood plain may still have vulnerable basement plant, low cable entries or an access road that becomes impassable.

Fortinet’s general guidance lists power plants, earthquake fault lines, flight paths, chemical facilities, hurricane and tornado exposure, wildfire zones and flood-prone areas as location risks. For UK facilities, translate that broad list into credible local exposures rather than copying an international checklist unchanged.

Its example of concrete walls at least one foot thick, approximately 305 mm, is also a design suggestion rather than a universal UK requirement. Wall thickness alone does not establish resistance to blast, fire or forced entry. Materials, reinforcement, openings and structural connections all matter.

The NPSA’s data centre security guidance provides a useful basis for assessing a facility’s wider security arrangements.

For an existing server room, the immediate options are usually more limited. Relocating equipment above a known flood level, separating shared service routes or protecting external plant may be more practical than changing the building.

Record dependencies beyond the boundary. Two electricity feeds or communications connections may still share an upstream route, substation or other point of failure.

Build a perimeter that delays intrusion

Establish progressively restricted zones

Divide the site into zones with increasing access restrictions. A typical arrangement separates the external boundary, reception, operational areas, data halls and individual customer racks.

Microsoft describes outer and inner perimeters, locked server racks, around-the-clock video surveillance and multi-factor access controls. The principle is increasing restriction as somebody approaches equipment and information.

Telehouse describes 360-degree perimeter fencing, dedicated 24/7 security, comprehensive access control and video monitoring coverage. These are useful examples of large-facility arrangements, not a minimum specification for every office server room.

Where fencing is justified as part of the site’s physical security, assess gates, ground clearance, neighbouring structures and places where stored materials create climbing opportunities. Anti-climb features need suitable design, lawful installation and ongoing maintenance.

Vehicle barriers should address the assessed vehicle threat. A parking barrier controls routine traffic but should not be treated as a hostile-vehicle mitigation system.

Include secondary routes and supporting plant

Inspect loading bays, roof access, service doors, cable routes and ventilation openings. An expensive main entrance provides limited protection when a contractor door remains unsecured.

External generators, fuel storage, cooling equipment and communications chambers may need separate protection. Interference with those assets can stop services without an intruder reaching a rack.

Assign responsibility for boundary inspections and repairs. Record damaged fencing, failed lighting, vegetation growth and changes caused by construction works or neighbouring activity.

For a server room inside a shared building, the effective perimeter may begin at the room door. Treat landlord-controlled entrances and shared corridors as dependencies, rather than assuming that the building’s reception provides continuous protection.

Control access according to role and risk

Use individual permissions and suitable authentication

Apply zero-trust principles by issuing individual credentials and restricting them by area, role and time. Facilities staff may need plant-room access without customer-cabinet access. Reception staff rarely need unrestricted entry to data halls.

Multi-factor authentication combines independent factors. These include something a person knows, such as a PIN; something they have, such as a credential or cryptographic USB security key; and something they are, such as a biometric characteristic.

A password and PIN are both knowledge factors. An ordinary USB storage device is not automatically an authentication token.

Select authentication according to the consequences of misuse. Card-and-PIN access may suit some restricted areas, whilst higher-risk environments may justify stronger credential protection, biometrics or additional approval.

Proofpoint presents biometrics as a high-security, high-cost access option. That does not establish that they are the strongest choice for every site. False acceptance, false rejection, accessibility and fallback procedures affect performance.

The choice between biometric access control systems and other methods should also account for privacy and the workforce using them.

Prevent access being shared or bypassed

An authenticated credential does not prove that only its holder entered. Anti-tailgating turnstiles permit one person through after authentication; security portals provide another option where the risk justifies them.

Include an accessible route with equivalent control. Emergency escape arrangements must remain compatible with applicable fire-safety duties.

Door-held-open alerts, forced-door alarms and staff challenge procedures address different failures. Test each against a named response, including outside normal working hours.

The access administrator should remove permissions promptly when employment, contracts or responsibilities change. Lost credentials need a clear reporting route and immediate suspension once reported.

Review privileged access separately. Master keys, override credentials and administrator accounts can defeat otherwise careful zoning, so their issue and use require stronger control and recording.

Manage visitors, contractors and deliveries as separate activities

Pre-register visitors against an approved host and purpose. At arrival, establish identity using a proportionate process, record entry and issue a clearly identifiable visitor badge.

Visitors should remain escorted in restricted areas. Record departure, recover credentials and reconcile anyone whose visit remains open after the expected finishing time.

A digital visitor-management system can notify hosts and produce occupancy records. It cannot establish that the visitor has authority to enter a particular rack or plant room.

Contractors need access matched to an approved work scope. Record the task, permitted areas, responsible contact and any restrictions on tools, photography, removable media or remote connections.

Recurring attendance should not become permanent unrestricted access. Maintenance arrangements need an expiry point and a process for changes to personnel.

Separate delivery reception from equipment release. A genuine delivery does not authorise the driver to enter the data hall, and a familiar engineer does not automatically have permission to remove hardware.

For equipment leaving site, record the asset, approving owner, destination and person collecting it. Serial-number records are useful where equipment is portable or difficult to distinguish visually.

Emergency maintenance needs a controlled exception process. Give the incident lead authority to approve time-limited access and require a record afterwards. Informal permission through an unrecorded phone call creates uncertainty about who authorised the work.

Keep visitor information out of public view at reception. Names, company details and visit purposes can expose sensitive relationships or operational activity.

Make CCTV useful and proportionate

Design coverage around a defined question

Camera placement should establish who entered, what route they took and what happened at a protected asset. A broad view of a room may not provide usable identification at its entrance.

Cover justified locations such as gates, reception approaches, restricted doors, loading areas and equipment-release points. Assess blind spots created by racks, open doors, vehicles and temporary works.

Test images at night, during poor weather and under changing lighting. Reflections, backlighting and infrared glare can make apparently complete coverage ineffective.

Check the whole recording path. A live picture does not prove that footage is being recorded, timestamps are correct or exported material can be viewed.

Remote monitoring needs agreed alarm priorities and response instructions. Excessive nuisance alerts should trigger investigation into placement, configuration or site conditions rather than habitual dismissal.

Set lawful boundaries for recording and retention

CCTV processing must have a lawful basis and a defined purpose. Restrict views into neighbouring homes, staff welfare areas and other places where recording would require stronger justification.

Provide appropriate privacy information before people enter monitored areas. Signage does not make unnecessary or disproportionate surveillance acceptable.

Limit access to authorised roles and record exports and disclosures. Where appropriate, maintain logs of viewing activity and apply suitable security to third-party monitoring connections.

There is no universal UK CCTV retention period. A 90-day period sometimes quoted in data-centre descriptions is an example of an operational policy, not a legal requirement. Nor is 31 days a statutory minimum.

Set retention according to the documented purpose and the time needed to identify incidents. Preserve relevant footage when an incident or lawful request requires it, with access and disposal controlled separately.

Biometric identification can involve special-category personal data. It requires an appropriate legal basis and additional conditions, with a data protection impact assessment where the processing is likely to create high risks.

Give guards a defined task and response authority

Guarding should address tasks that require judgement, physical attendance or controlled intervention. These can include identity challenges, escorted access, patrols, delivery checks and response to an intrusion alarm.

Write post instructions around the facility’s operations. State which doors the officer controls, which systems they monitor, who authorises exceptions and when they should escalate.

A reception post may become ineffective when its officer also escorts contractors, checks deliveries and investigates alarms. Assess simultaneous demands rather than counting the number of officers on the rota.

If an escort takes the only officer away from a controlled entrance, the staffing plan needs an explicit replacement control.

Training should cover site-specific hazards, including electrical plant, batteries, suppression systems and restricted maintenance areas. Security officers should not enter hazardous spaces simply because an alarm has activated.

Compare manned guarding and automated security according to threat detection, attendance and intervention requirements. Technology may extend coverage, but it does not remove the need for someone to act.

For unattended premises, define monitoring, dispatch, safe access and escalation arrangements. Keyholding and alarm response should include current site instructions, controlled credentials and written incident reports.

Response arrangements also need fallback contacts. An unanswered call to a single facilities manager should not leave the monitoring centre without further instructions.

Protect racks, equipment and removable media

Locked racks provide another boundary within a secure room. Specify who may open each cabinet and how access is recorded, particularly where several customers share a data hall.

Inspect side panels, rear doors and other routes to the equipment. A locked front door provides limited separation if neighbouring cabinet space allows access behind it.

Protect console connections, management interfaces and network equipment as well as servers. Physical access can permit configuration changes or the connection of unauthorised devices.

Media handling needs its own chain of custody. Record disks, backup media and other storage devices when issued, transferred, repaired, reused or destroyed.

A failed drive may still contain recoverable information. Returning it under warranty requires an approved decision about sanitisation, retention or an appropriate secure-return arrangement.

Encryption reduces some exposure from stolen media, but depends on implementation and key protection. The ICO’s guidance on encryption and data protection explains its place within risk-based security measures.

Maintain an asset register that supports investigation. It should identify the equipment owner, location, relevant identifiers and approved movement history.

Proofpoint also describes a Faraday cage as an additional barrier. Electromagnetic shielding addresses particular risks; it does not replace entry control and is not a routine requirement for UK server rooms.

Use specialist shielding only where a defined threat, interference problem or contractual requirement supports it.

Protect against fire, water and utility failure

Match fire protection to the building and equipment

Fire protection requires detection, containment, safe evacuation and a suitable means of controlling the fire. Selecting a suppression product before assessing those needs can leave important gaps.

Clean-agent or inert-gas fire suppression systems are used in some server environments because they avoid water discharge and leave little or no residue. Their suitability depends on the hazard, room enclosure, occupancy and system design.

Water-based systems, including engineered water-mist or sprinkler arrangements, are not automatically unsuitable. The Euralarm guidance on data-centre fire protection explains why system selection needs a considered assessment.

Appoint competent specialists for design and maintenance. Cable penetrations, ventilation changes or alterations to room boundaries can affect fire compartmentation and gaseous-system performance.

The March 2021 OVHcloud fire in Strasbourg destroyed thousands of servers and caused extended disruption. It also demonstrated why recovery arrangements must account for loss of an entire facility.

Treat supporting infrastructure as protected assets

Monitor water leaks, temperature and humidity where they affect equipment. Sensors need clear alarm thresholds, escalation instructions and a maintenance programme.

Protect electrical distribution, uninterruptible power supplies, generators and fuel arrangements against unauthorised interference. The same applies to cooling controls, pumps and external heat-rejection equipment.

Redundancy only helps when duplicated systems avoid common failures. Separate units may still depend on one control system, shared fuel, the same pipework or a single maintenance error.

Record permitted work near live services and define change approval. A routine maintenance visit can create an outage if isolation points or dependencies are poorly understood.

Recovery testing should include loss of the room, unavailable staff and damaged security controls. Backups held beside the production equipment may be affected by the same fire, flood or theft.

Secure the systems that operate the building

Access controllers, cameras, recorders, environmental sensors and building-management systems are connected technology. They require asset records, configuration control and security maintenance.

Replace default credentials and restrict administrator access. Apply multi-factor authentication to remote administration where supported, and remove supplier access when the approved work ends.

Segment operational systems according to function and risk. A camera network should not provide an unnecessary route into production systems or privileged management interfaces.

Record older equipment that no longer receives security updates. Its continued use needs an explicit risk decision and suitable restrictions, rather than an assumption that physical isolation remains effective.

Include firmware and operating-system updates within a coordinated maintenance plan. Changes to security or building systems may affect availability, so test and authorise them appropriately.

The 2023 T-Mobile API incident illustrates a different failure route: misuse of a software interface exposed customer information without requiring physical entry. It should not be described as evidence that physical data-hall controls failed.

Maintain protected backups of access configurations, approved permissions and other critical settings. Test whether security operations can be restored after ransomware, a failed update or loss of the management platform.

Out-of-band or local operating arrangements may be necessary during network failure. Document who can use them and how activity is recorded afterwards.

A security system that becomes unavailable during an IT incident can leave both teams managing the same emergency with reduced visibility.

Distinguish UK legal duties from recommended controls

Apply duties according to processing and control

The UK GDPR requires appropriate technical and organisational measures when personal data is processed. Its requirements apply according to risk, including confidentiality, integrity, availability, restoration and testing.

The ICO’s guide to data security explains that approach. Article 32 identifies encryption as a measure to use as appropriate; it does not impose identical encryption arrangements on every organisation or dataset.

Encrypting personal data in transit and at rest is often appropriate, alongside controlled access and defined retention. Encryption does not remove the remaining duties.

Fire-safety responsibilities depend on the premises and who controls them. In England and Wales, the Regulatory Reform (Fire Safety) Order 2005 establishes duties for the responsible person and others with relevant control.

A suitable and sufficient fire-risk assessment is required for premises within its scope. Landlords, operators, employers and tenants may hold overlapping responsibilities. Scotland and Northern Ireland have separate fire-safety regimes.

Record the division of duties in shared buildings. A lease or service agreement should identify operational responsibilities without assuming it can remove statutory obligations.

Separate licensing, sector duties and voluntary assurance

SIA licensing depends on the activity and contractual arrangement. Contracted security guarding and keyholding can require licences; the rules do not support saying every in-house security employee needs one.

Public space surveillance licensing also depends on the work performed and its purpose. Assign the appropriate role and licence category rather than treating all surveillance work alike.

The UK designated data centres as critical national infrastructure in September 2024. That sector designation does not itself prescribe identical barriers, staffing or certifications for every server room.

Sector-specific obligations, including applicable NIS requirements, depend on legal scope and the services provided. Proposed regulatory changes must not be presented as duties already in force.

ISO/IEC 27001, SOC 2 reporting and technical design standards are not universal statutory requirements. They may become relevant through procurement, contracts, insurance conditions or particular operating arrangements.

Maintain a obligations register that distinguishes law, contract and guidance, with a named owner for each requirement.

Read ISO 27001 and SOC 2 evidence properly

Match ISO certification to its stated scope

ISO/IEC 27001:2022 sets requirements for an information security management system, or ISMS. It addresses the management of risks affecting confidentiality, integrity and availability.

Certification is voluntary unless required through another arrangement, such as a contract. It establishes conformity within the stated certification scope, not coverage of every activity carrying the provider’s brand.

Procurement staff should assess the legal entity, services, locations, edition and validity shown in the certificate. Match those details to the facility and service under consideration.

The Statement of Applicability explains which Annex A controls are applicable and the reasons for inclusion or exclusion. It helps establish how risk decisions relate to implemented controls.

In the 2022 edition, physical controls sit within Annex A section 7. References to A.11 usually relate to the earlier 2013 structure.

An audit certificate is useful evidence. It does not establish that a particular door alarm worked last night or that a customer followed its own access procedure.

Read the SOC 2 report beyond the description

SOC 2 is an independent attestation report, not an ISO-style certification. Its Trust Services Criteria cover security, availability, processing integrity, confidentiality and privacy.

Security is included in SOC 2 examinations; the other categories depend on scope. A report described simply as “SOC 2” does not establish that all five were examined.

A Type I report addresses design at a specified date. A Type II report also addresses operating effectiveness over a defined period.

Read the auditor’s opinion, system description, testing and exceptions. Relate any exceptions to the service being purchased rather than treating their existence as an automatic pass or fail.

Identify complementary user-entity controls, which are actions the customer is expected to perform. Also identify excluded suppliers or facilities and how subservice organisations are treated.

Record the reporting period and material changes since it ended. Neither a clean report nor a current certificate guarantees uninterrupted service or removes shared responsibilities.

Test the controls and keep usable evidence

An audit should connect a claimed control to an observable result. A procedure establishes what should happen; operating records and controlled tests show whether it happens.

Use a small number of end-to-end tests rather than reviewing documents alone.

A failed test needs a recorded action, owner and completion date. Repeat the relevant test after correction rather than closing the issue on an assurance that work is finished.

For a door-held-open exercise, record when the event began, when the system detected it and when somebody acted. Those stages reveal whether the weakness lies in detection, monitoring or response.

Agree test boundaries beforehand. Exercises must not compromise emergency escape, expose live equipment or create an uncontrolled confrontation.

The ICO’s security outcomes guidance supports regular evaluation of whether measures remain appropriate.

Review controls after changes to occupancy, customer requirements, rack layouts, suppliers or building services. Maintenance records should cover camera cleaning, sensor condition, communications, backup power and alarm transmission.

Keep sensitive evidence under controlled access. Floor plans, administrator lists and detailed weaknesses should not circulate as ordinary sales material.

Scale expenditure to the facility and workload

Fund the control that addresses the actual weakness

An office server room may need a sound door set, individual access permissions, monitored alarms, suitable environmental protection and disciplined contractor control. A dedicated guard at that door may add little where the wider building already has effective coverage.

A shared colocation facility has different demands. Multiple customers, continuous maintenance and frequent equipment movements can justify staffed access points, stronger zoning and cabinet-level controls.

High-density AI workloads increase the consequences of interference with cooling and power. Liquid-cooling connections, specialist maintenance and valuable accelerator hardware require attention within the risk assessment.

Density does not automatically justify biometrics at every boundary. It may instead justify closer plant monitoring, tighter maintenance permissions or improved equipment-release controls.

Include operating costs and coverage gaps

Budget for installation, maintenance, software, communications, credential administration, testing and replacement. Equipment that cannot be maintained creates a recurring weakness.

One continuously staffed post requires 8,760 coverage hours in a 365-day year. Leave, training, breaks, supervision and absence require additional staffing arrangements.

Compare options against the required task and response. A scheduled patrol cannot provide continuous observation, and remote monitoring cannot physically secure a damaged door.

Do not use historical breach averages as a current UK staffing calculation. Older figures quoting 39% negligence, 37% malicious attacks and a $5.5 million average reflect a particular survey context, not the expected loss for this facility.

Use the organisation’s service dependencies, recovery costs and contractual exposure instead. Record the residual risk when a proposed control is deferred or rejected.

Frequently asked questions

Do all server rooms need 24/7 security guards?

No. The requirement depends on threats, building arrangements, response capability and the consequences of unauthorised access or interruption.

Continuous guarding may be justified for busy, high-risk or operationally sensitive facilities. A smaller room may be adequately protected through controlled access, monitored detection and reliable attendance arrangements. The assessment must cover nights, weekends and maintenance visits, rather than relying on normal office activity.

Does a Tier III or Tier IV rating prove security?

No. Uptime Institute tier classifications concern infrastructure topology and availability characteristics. They are not a substitute for evaluating access control, personnel procedures or customer-data protection.

Assess security evidence separately from availability claims. A facility can have substantial redundancy while retaining weaknesses in visitor handling, media disposal or privileged access.

Are there health risks or a safe distance for nearby residents?

There is no single safe residential distance applicable to every data centre. Relevant local issues can include generator emissions, noise, fuel storage, construction activity and traffic.

Assessments depend on the equipment, operating pattern, surroundings and applicable planning or environmental controls. Facility security arrangements do not establish whether those impacts are acceptable. Concerns should be addressed through the relevant planning, environmental-health or permitting process, rather than an unsupported blanket distance.

Keep protection tied to operational responsibility

Effective data centre security depends on controlled movement, protected infrastructure and a response that works when normal arrangements fail. The appropriate combination changes with the facility, workload and consequences of interruption.

Give each significant control a named owner, an operating procedure and evidence that it works. A locked room is useful only when the surrounding access, maintenance and response arrangements support it.