Site rules, access control and escorts

Your first experience of a data center is usually its security. Before you see a single rack you may pass a fence, a vehicle barrier, a guard house, a lobby where your identification is checked against an approved visitor list, and a mantrap that lets only one person through at a time. Inside, every door may need a badge, a PIN or a fingerprint. Cameras watch the corridors, and the security operations center logs every swipe. To someone from a construction site or a factory this can feel excessive. It is not just about protecting customer data. Many of the access rules are also safety rules, and understanding why they exist makes them easier to follow.

This lesson explains how access control is layered, what the common site rules are and why they matter, how escorts work, and what your responsibilities are as a visitor, contractor or employee. Physical security design, including the engineering of barriers, readers and camera systems, is covered in DCE-440; here the focus is on what you will be asked to do and why.

Layers of access control

Data centers use defense in depth: several layers of protection, each of which must be passed to reach the most critical spaces. If one layer fails, the next still stands. A typical arrangement has five or six layers, shown in the figure below, though the details vary by operator and by the security level a customer requires.

The site perimeter usually has a fence, a controlled gate and sometimes crash-rated barriers against vehicle attack. Deliveries are checked at the gate or at the loading dock. The building entrance has a guard desk or reception where identification is checked against an approved access list; visitors without an approved request are turned away, however important they are. A mantrap or interlocked portal is a small vestibule with two doors that cannot both be open at once, often with a weight sensor or camera to detect a second person. It prevents tailgating, where an unauthorized person follows an authorized one through a door.

Inside, the corridors lead to data halls, which have their own readers, sometimes with biometrics such as fingerprint, palm or iris scanning. In colocation facilities each customer's equipment may be in a locked cage or suite, and individual cabinets may have keys or electronic locks. Gray space rooms such as electrical rooms, battery rooms and fire suppression rooms are restricted to people who are authorized and, for electrical spaces, qualified for the work they will do there.

Why access rules are also safety rules

It is easy to see access control as purely about protecting equipment and data. Several of its effects are just as important for safety.

Knowing who is in the building is essential in an emergency. If the fire alarm sounds, the people coordinating the evacuation need to know who is inside and where, so that they can account for everyone at the assembly point and tell firefighters whether anyone is missing. Badge records, sign-in sheets and escort logs are how that headcount is done. A person who tailgated, or who left without badging out, can send rescuers looking for someone who is not there, or leave someone unaccounted for who is.

Some spaces have hazards that only certain people should face. Electrical rooms contain switchgear where arc flash and shock hazards exist; only qualified persons, or people escorted by qualified persons, should enter. Battery rooms may contain corrosive electrolyte, flammable gases or lithium-ion cells. Rooms protected by clean agent fire suppression systems may discharge without much warning, and some agents, or the oxygen reduction caused by inert gases, are hazardous at the concentrations used; HSE-323 covers that in detail. Controlling access to these rooms is a direct safety control.

Access control also enforces change control. If only authorized people can reach a piece of equipment, it is much harder for someone to make an unplanned change, such as unplugging a cable, opening a breaker or adjusting a cooling setpoint, that could cause an outage or create a hazard for someone else working downstream.

Escorts

Most data centers require visitors and many contractors to be escorted. An escort is an authorized person who accompanies someone without unescorted access, keeps them within sight, makes sure they go only where their work requires and follows them out. Escorts are not just guides; they are responsible for what their visitors do.

Common site rules

Every data center has a set of site rules, usually given in an orientation and posted at the entrance and in data halls. They vary, but most include rules in the following areas. Each has a safety reason as well as an operational one.

• No food or drink in the data halls or electrical rooms. Spills can damage equipment and create electrical hazards, and food attracts pests.
• No cardboard, wooden pallets or packaging in the data hall. Equipment is unpacked in a staging room. Packaging adds fire load, sheds dust that can trigger very sensitive smoke detectors, and creates trip hazards; NFPA 75 limits combustible materials in IT equipment areas.
• No photography without permission. Photographs can reveal security details and customer information.
• Personal protective equipment as required by the area and task, such as safety footwear in the loading dock, hearing protection in plant rooms and arc-rated clothing for electrical work.
• No hot work, such as welding, cutting or brazing, without a hot work permit, because of fire risk and the chance of setting off detection or suppression systems.
• No ladders, lifts or tools brought into a hall without approval, and no work above equipment without controls for falling objects.
• No touching equipment outside the scope of your approved work, even to tidy a cable or close a cabinet door.
• Report every incident, near miss and hazard, however small.

Many sites add rules about lone work. Some spaces, such as electrical rooms or generator enclosures, may require two people for certain tasks. Others allow lone work only with a check-in system, where the security operations center or a colleague contacts the worker at fixed intervals and escalates if there is no reply.

Getting in: the access request

Unescorted access to a data center is normally granted only after a formal request. For a contractor, that usually means the hiring party submits an access request listing the people, dates, areas and the approved change or work order. Security checks identification and may require a background check, especially for unescorted access. The person completes site orientation and any required training, signs an acknowledgment of the site rules and receives a badge that works only in the approved areas and times.

This process takes time, which is one reason last-minute work in data centers is difficult. A crew member who was not on the access request may be turned away at the gate even if the rest of the crew is inside. Good planning, covered in Lesson 9, includes making sure access requests are submitted early.

import random

# Reconcile badge-in and badge-out events to build an emergency headcount
random.seed(33)
people = ["Ava (tech)", "Ben (vendor)", "Chen (vendor)", "Dara (cleaner)", "Eli (visitor)"]
events = []
for p in people:
    t_in = random.randint(7 * 60, 9 * 60)          # minutes after midnight
    events.append((t_in, p, "IN"))
    if random.random() < 0.6:
        events.append((t_in + random.randint(60, 240), p, "OUT"))
events.sort()
inside = set()
for t, p, kind in events:
    if kind == "IN":
        inside.add(p)
    else:
        inside.discard(p)
    print(f"{t // 60:02d}:{t % 60:02d} {kind:3s} {p}")
print("Badge records say still inside:", sorted(inside))

07:23 IN  Eli (visitor)
08:01 IN  Chen (vendor)
08:13 IN  Ava (tech)
08:44 IN  Ben (vendor)
08:54 IN  Dara (cleaner)
10:12 OUT Ava (tech)
12:09 OUT Dara (cleaner)
Badge records say still inside: ['Ben (vendor)', 'Chen (vendor)', 'Eli (visitor)']

A headcount built from badge data is only as good as the badging. If one of the people shown as inside actually tailgated out behind a colleague, emergency coordinators would search for someone who had already left. If someone tailgated in, they would not appear at all.

Egress always comes first

Security wants to keep people out; safety requires that people can always get out. Building and fire codes require that exits remain usable, and they allow security hardware such as delayed-egress locks and interlocked portals only under conditions set by the code, such as automatic release on fire alarm or power failure. Never prop open, block or bypass an exit door, and report any exit that is locked, obstructed or does not open freely. In an evacuation, follow the exit signs and the instructions of wardens; do not stop to badge out unless the site's emergency procedure tells you to use a specific reader at the assembly point.