Physical Security and Environmental Monitoring

What threatens the equipment

Logical security protects data on the network; physical security protects the machines it runs on. In a data center the threats come in a few groups:

• People: theft of drives or whole servers, sabotage, an unauthorized visitor plugging something in, and, far more often, honest mistakes such as pulling the wrong cable or the wrong disk.
• Fire: an overheated power supply, a failing battery, a cable fault. Even a small fire produces smoke and soot that can damage equipment far beyond the flames.
• Water and other liquids: a leaking chilled-water pipe, a coolant leak in a liquid-cooled rack, a roof leak or condensation.
• Environment: heat, too much or too little humidity, dust.

The general principles (layers, deterrence, detection, the access control vestibule, CCTV, disposal) are on Physical Security in the Security topic. This page applies them to a data hall and adds the fire, water and sensor side.

Access control in layers

A data center is designed so that reaching a server means passing several independent controls, each stricter than the one before. If one layer fails (a door is propped open, a badge is stolen), the next one still stops the intruder, and every passage leaves a record.

Perimeter and building

The outer layers aim to deter and delay. Fences, gates and bollards (short posts that stop vehicles) keep cars and trucks away from walls and entrances. Many data centers deliberately look unremarkable: no company logo, no sign saying "data center", few windows. Exam objectives call this data center camouflage, together with reflective glass that hides what is inside and architectural reinforcements such as reinforced walls and vehicle-resistant entrances. Inside, a staffed reception or security desk checks identity, registers visitors and hands out badges. Visitors are escorted, and their visit is logged with time in and time out.

Data hall, cage and rack

The data hall itself is usually entered through a mantrap, which CompTIA's newer exams call an access control vestibule: two interlocked doors, of which only one can be open at a time, often with a sensor that detects more than one person inside. It is the standard countermeasure against tailgating. Entry typically requires two factors: an RFID badge plus a PIN or a biometric check (fingerprint, palm vein or face).

In colocation facilities each customer's equipment sits in a cage (a mesh enclosure with its own lock) or in individually locked racks. Rack locks range from keys and combination locks to electronic handles that log every opening and can be tied to a badge. Inside the hall, cameras cover the aisles and doors; their images are personal data under the GDPR, so retention and signage follow privacy rules (see Privacy and Data Protection).

Procedures matter as much as hardware. Access rights are granted per person and per area, reviewed regularly and removed the day someone leaves. Contractors and remote-hands staff get time-limited access tied to an approved change or work order. Any door alarm (a door forced or held open too long) goes to a staffed security desk.

Fire detection

Fire in a data hall rarely starts with flames. It starts with an overheating component that slowly releases a little smoke, sometimes for a long time. Ordinary point smoke detectors on the ceiling react only once enough smoke reaches them, and strong airflow from the cooling system dilutes smoke before it gets there.

Aspirating smoke detection (ASD) solves this by actively drawing air through a network of small pipes with sampling holes, for example along the return-air path and above the racks, to a very sensitive detector. It can detect smoke at concentrations far below what a person would notice. VESDA (very early smoke detection apparatus) is a well-known brand of ASD and often used as the generic name.

Because it is so sensitive, ASD is configured with several alarm levels. A typical sequence looks like this (the names and thresholds vary per site):

1. Alert: a trace of smoke. Staff investigate: a hot smell, a failing power supply, dust from construction work.
2. Action: more smoke. Staff are dispatched; equipment may be powered down.
3. Fire 1: the fire alarm sounds and the room is evacuated.
4. Fire 2, usually confirmed by a second, independent detector: suppression is released after a short pre-discharge countdown.

Fire suppression

A fire suppression system is the fixed installation that automatically puts out or controls a fire once detection confirms it: sprinklers, water mist or a gas that is released into the protected room. In a data center the choice is a trade-off between putting out the fire and not destroying the equipment in the process.

Water-based systems

Building codes or insurers often require sprinklers. Data halls use pre-action sprinklers: the pipes are filled with air, not water, until the detection system confirms a fire, and only then do they fill. A sprinkler head still has to open from heat before water flows. This avoids the nightmare of a pipe or head that leaks water onto running servers by accident. Water mist systems use very fine droplets that cool the fire with much less water.

Gaseous suppression

Gas systems use a clean agent: an electrically non-conductive extinguishant that leaves no residue. The gas floods the whole room within seconds, and the equipment can often be cleaned and restarted. There are two families:

• Inert gases such as IG-541 (a mix of nitrogen, argon and carbon dioxide, sold as Inergen), IG-55, argon (IG-01) or nitrogen. They lower the oxygen level in the room until a fire can no longer burn. They need large banks of gas cylinders.
• Halocarbon (chemical) agents, which mainly remove heat from the fire. Common agents are HFC-227ea (known as FM-200) and FK-5-1-12, formerly sold by 3M as Novec 1230. HFC-227ea is a hydrofluorocarbon with a high global warming potential. Under the EU F-gas Regulation (EU) 2024/573, new fire protection systems containing it may no longer be placed on the market from 1 January 2025, unless safety requirements at the site demand it; existing systems may stay in service and be refilled with recycled or reclaimed gas. 3M ended its production of PFAS chemicals, including Novec 1230, at the end of 2025, but FK-5-1-12 is still made by other manufacturers. Because FK-5-1-12 is itself a fluorinated substance, future EU PFAS restrictions may affect it.

A gas system only works if the room holds the gas. Holes for new cables, a missing ceiling tile or a door wedged open let the agent escape, so rooms get regular room integrity tests and cable penetrations are sealed after every change. Rooms also need pressure relief vents: a sudden discharge raises the air pressure, and without relief that can damage walls and doors. Discharge nozzles are loud; poorly placed or unsilenced nozzles have been known to damage spinning hard disks, which is why modern installations use silencing nozzles.

Many sites, especially in the United States, also have an emergency power off (EPO) button that cuts power to the whole room for the fire brigade's safety. It sits under a protective cover for a reason: pressing it by accident takes everything down at once.

Water and leak detection

Water reaches data halls in mundane ways: a cracked chilled-water pipe, a blocked condensate drain in a cooling unit, a roof leak, and, increasingly, a coolant leak in a liquid-cooled rack. Under a raised floor, water can spread for a long time before anyone sees it.

Water leak detection places sensors where liquid would appear first, so that a leak raises an alarm before it reaches power or equipment. It uses two kinds of sensors:

• Sensing cable, laid in loops under the raised floor, around cooling units and along pipe runs. Zone cable only tells you that a zone is wet; location-reporting cable tells you how many meters along the cable the water is.
• Spot sensors in drip trays, under coolant distribution units (CDUs) and at the lowest point of a room.

With direct-to-chip liquid cooling (see Cooling and Airflow), leak sensors move into the rack itself: under manifolds, at quick-release couplings and in the CDU. Some CDUs can automatically close valves when they detect a leak.

Environmental monitoring

Environmental monitoring is the continuous measurement of the physical conditions around the equipment, with alerts when a value crosses a threshold. Typical sensors in a data hall:

• Temperature at the front (inlet) of racks, at several heights, because that is what the equipment breathes. ASHRAE's recommended inlet range is 18–27 °C (see Cooling and Airflow).
• Humidity or dew point: too dry raises the risk of electrostatic discharge, too humid risks condensation.
• Differential air pressure between a contained aisle and the room, which shows whether containment works.
• Leaks, smoke (from the fire system), and door contacts on halls, cages and racks.
• Power: current per rack PDU and per circuit, which overlaps with the electrical monitoring of the power chain.

The readings flow into a building management system (BMS), into data center infrastructure management software (DCIM, see Operations and Lifecycle), or into the same monitoring platform the NOC uses for servers and network, usually over SNMP (see Operational Services), Modbus or BACnet. Servers report their own inlet temperature through their management controller as well (see Out-of-Band Management), which gives a second, independent reading.

The example below evaluates one polling cycle against a set of thresholds, as a monitoring system does every minute. Only the readings that need attention are printed.

# One polling cycle of a small data hall's sensors: (sensor, kind, value)
readings = [
    ("R01-inlet-top", "inlet_c", 24.5),
    ("R01-inlet-bottom", "inlet_c", 19.0),
    ("R07-inlet-top", "inlet_c", 28.6),
    ("R07-inlet-mid", "inlet_c", 26.1),
    ("R12-inlet-top", "inlet_c", 33.4),
    ("CDU-2-tray", "leak", 1),
    ("Door-hall-A", "door_open_min", 14),
]

RECOMMENDED = (18.0, 27.0)  # ASHRAE recommended inlet range, °C
CRITICAL_C = 32.0           # upper allowable limit for class A1 equipment
DOOR_LIMIT_MIN = 5          # site rule: a hall door may stay open 5 minutes

def evaluate(kind, value):
    if kind == "inlet_c":
        if value > CRITICAL_C:
            return "CRITICAL", "inlet above the allowable range"
        if not RECOMMENDED[0] <= value <= RECOMMENDED[1]:
            return "WARNING", "inlet outside the recommended range"
    elif kind == "leak" and value:
        return "CRITICAL", "liquid detected"
    elif kind == "door_open_min" and value > DOOR_LIMIT_MIN:
        return "WARNING", f"door open for {value} minutes"
    return "OK", ""

for sensor, kind, value in readings:
    level, reason = evaluate(kind, value)
    if level != "OK":
        print(f"{level:8} {sensor:17} {value:>5}  {reason}")

WARNING  R07-inlet-top      28.6  inlet outside the recommended range
CRITICAL R12-inlet-top      33.4  inlet above the allowable range
CRITICAL CDU-2-tray            1  liquid detected
WARNING  Door-hall-A          14  door open for 14 minutes

Real systems add two things this sketch leaves out. First, rate of change: an inlet that climbs 3 °C in five minutes is more urgent than one that has sat at 28 °C all week. Second, deduplication and correlation: when a cooling unit fails, forty rack sensors alarm at once, and the NOC needs one incident, not forty pages. See Monitoring and Event Management for thresholds and alert fatigue.

Putting it together: a night shift

At 02:10 the NOC receives an "Alert"-level warning from the aspirating smoke detector in data hall B, followed a minute later by a power warning for one rack. The on-call engineer checks the cameras, sees nothing visible, and calls the site's security officer, who goes to the hall with a hand-held thermal camera. The source is a single server power supply with a burnt smell. Following the procedure, the engineer moves the workload, the server is shut down remotely through its management controller, and the power supply is replaced in the morning under a change.

Nothing in that story required the suppression system. That is the point of the layers: early detection, monitoring that correlates smoke with power, and people who know the procedure turn a potential fire into a hardware replacement.