Physical security for server rooms, network closets, and devices

Reference article · 5 min read

Security programs concentrate on what can be configured remotely: patching, identity, logging, network segmentation. The physical layer gets less attention, because it belongs to facilities rather than IT and because the equipment has sat where it is for years. Assessors look anyway. An auditor who cannot get a clear answer about who holds a key to the room with the servers in it will write a finding regardless of the firewall rules.

The questions are few and unglamorous. Where is the equipment, who can reach it, is that access recorded, what happens when power or plumbing fails, and what happens to a drive after it leaves the building. Remodels and relocations reopen all of them, usually just before an assessment.

Controlled and logged access to equipment rooms

An authorization list. A written list of who may enter, tied to job duties, reviewed on a schedule, and updated when someone transfers or leaves. Physical access should be removed the same day as the network account.
Access control that produces a record. A badge reader creates an entry log. A keyed lock creates nothing. If the room is keyed, keep a key control log showing who holds which key, and rekey when one cannot be accounted for.
Visitor handling and escorts. Anyone not on the list signs in, shows identification, and is escorted for the duration. That includes HVAC, electrical, fire alarm, and cabling contractors, not only technology vendors.
The room itself. A locked door in a partition wall that stops at the drop ceiling is not a barrier. Check walls to the deck, hinge pins, and whether the door is propped open for airflow.
Monitoring. Camera coverage of the entrance, with defined retention, and an alarm on doors held open.

The wiring closet in a shared building

Server rooms get attention. Wiring closets in libraries, community centers, courthouses, and leased space often do not. The familiar pattern is a closet shared with janitorial supplies, opened by a building master key that many people carry, and propped open because the switch runs hot. Inventory every closet holding network equipment and decide which ones reach sensitive systems. Put those on separate keying or an electronic lock that logs, and take the storage out. Where a closet cannot be secured, document that and compensate: lock the rack rather than the room, disable unused ports, apply port security or network access control, and keep stored data out of that closet.

Power, cooling, and water

Power. Batteries age, and an uninterruptible power supply never tested under load is an assumption rather than a control. If a generator serves the room, confirm it carries the room's circuits and that the transfer switch is exercised.
Cooling. Building air conditioning that shuts off nights and weekends will cook equipment. Dedicated cooling needs its own monitoring and maintenance schedule.
Water. Look above the ceiling and below the floor. Pipes, roof drains, restrooms overhead, and sprinkler heads are common causes of equipment loss. Leak detection is inexpensive, and nothing should sit on the floor.
Alerting. Temperature, humidity, and water sensors matter only if they reach someone able to respond.

Equipment that leaves the building

Laptops, tablets, mobile data computers, portable radios, and removable drives spend time in vehicles, homes, and field offices. Full disk encryption is the control that holds when a device is lost, and it should be verified rather than assumed. Keep assignment records, require prompt reporting of loss or theft, and maintain a remote wipe path. A vehicle is a storage location of last resort, and policy should say so.

Media sanitization, disposal, and chain of custody

Account for media when it is removed. Record serial numbers as a drive comes out of service, not when it reaches the surplus dock.
Sanitize using a recognized method. NIST Special Publication 800-88 describes clear, purge, and destroy as distinct outcomes and is the reference most assessors expect you to name.
Destroy what cannot be sanitized. Failed drives and some solid state media should be physically destroyed rather than overwritten.
Keep chain of custody. A short form covering who removed the media, serial numbers, where it was held, who transported and destroyed it, and the date answers most audit questions.
Remember the devices nobody calls storage. Copiers, network appliances, video recorders, phones, and backup tapes all retain data.

If a vendor performs destruction, require serialized certificates, the option to witness, and clarity about whether it happens onsite or after transport.

Physically secure locations in criminal justice settings

The CJIS Security Policy uses the term physically secure location for a facility, area, room, or container protected by physical and personnel controls sufficient to protect criminal justice information and the systems handling it. Where that cannot be met, the policy contemplates a controlled area with compensating measures. Auditors ask because the answer changes what else applies, including authentication expectations for access from outside such a location. The policy is revised periodically, so confirm current language through your state CJIS Systems Agency.

How to start, and what to require

Walk every space holding equipment with facilities staff, and photograph what you find.
Reconcile each space's access list against current employment and duties.
Write a short standard covering access, escorting, environmental monitoring, and disposal, and attach it to the checklist for any remodel or move.
In contracts and work orders, require escorted access, name the staff who may enter, require screening where the data demands it, and require badge and key return at closeout.
Ask hosting and managed service vendors about their facility controls and the sanitization practices they apply to your data.

HQT works with state and local agencies on security assessment and systems engineering, including the facility controls that assessments examine.

Frequently asked questions

What is a physically secure location under the CJIS Security Policy?

The policy uses the term for a facility, area, room, or container protected by both physical and personnel controls sufficient to protect criminal justice information and the systems that handle it. Where that standard cannot be met, the policy contemplates a controlled area with compensating measures instead. The distinction matters because it affects other requirements, including expectations for authentication when access originates outside such a location. The policy is revised periodically, so confirm current language through your state CJIS Systems Agency.

Does a wiring closet need its own lock if the building already has a master key system?

Usually yes, if the equipment in that closet reaches systems holding sensitive data. A building master key carried by custodial, maintenance, and after-hours staff gives access to people who are not on any technology authorization list and produces no record of entry. Putting those closets on separate keying, or on an electronic lock that logs, gives you both control and evidence.

How should an agency document hard drive destruction for an audit?

Record serial numbers when the media is removed from service, not when it reaches surplus, and keep a chain of custody form showing who removed it, where it was stored, who transported it, who destroyed it, and on what date. Use a recognized sanitization method; NIST Special Publication 800-88 is the common reference and distinguishes clear, purge, and destroy. If a vendor performs destruction, require a serialized certificate of destruction and the option to witness.

Is it acceptable to leave a laptop or portable radio in a vehicle?

Treat a vehicle as a storage location of last resort and say so in policy. Full disk encryption is the control that actually protects data when a device is taken, so verify it is enabled rather than assuming it. Keep assignment records so you can identify who held a specific device, and require prompt reporting of loss or theft so accounts and remote wipe can be triggered.

What should we check before moving equipment into a new space during a remodel?

Look at access first: whether the door can be controlled and logged separately, whether walls run to the deck, and who already holds keys to that area. Then look at the environment, including power and generator coverage, dedicated cooling, and anything overhead that carries water. Making the walkthrough part of the project checklist is far cheaper than discovering the problems during an assessment.