If you run a data center or a colocation facility, you can probably describe your physical security layers from memory. There is the fence, the lobby, the mantrap, the cage, and the rack, and each layer has its own badge reader or biometric check. What you may have a harder time answering is a simpler question: who is responsible for physical security at a data center, by name, with the authority to change it? In my experience the answer in most facilities is a shrug followed by a list of departments, and that list is the problem.
I have walked through facilities where the guard force reports to the facilities director, the access control system belongs to IT, the cameras were installed by a vendor nobody has spoken to in two years, and the CISO signs the compliance attestations without ever having pulled on a door. Every one of those people believes someone else owns the whole picture. When a customer auditor or an incident finally forces the question, the organization discovers it has plenty of security activity and no security leadership. This article is about how that happens and what a responsible operator does about it.
Why the Question Has No Clean Answer
Data centers grew up as engineering organizations. The people who built them cared about power, cooling, uptime, and network capacity, and physical security was treated as a building feature, like the fire suppression system. So the guard contract went to facilities because facilities managed the building. The badge system went to IT because it ran on the network. Cameras went to whoever had budget the year they were installed. Each decision made sense on its own, and together they produced a program with four or five partial owners and no single one.
Then compliance arrived. Customers began asking for SOC 2 reports and similar attestations, and those reports include physical access controls. The natural person to sign was the CISO, because the CISO already owned the audit relationship. That created a strange arrangement where the executive accountable on paper for the mantrap and the visitor log spends nearly all of their attention on network threats, and the people who actually run the mantrap and the visitor log do not report to them. Accountability and control ended up in different buildings.
What Divided Ownership Looks Like on the Floor
The symptoms are consistent from one facility to the next. Access permissions drift because nobody owns the review. A contractor is granted cage access for a two-week install and still holds it eighteen months later, because the project manager who requested it assumed access control would remove it and access control assumed the project manager would say when. Escort requirements exist in the policy and get waived on the floor when a familiar vendor shows up during a busy shift. The visitor log is kept because the auditor asks for it and reviewed by no one for any other reason.
Cameras deserve their own mention. Nearly every data center I have seen has excellent coverage, high resolution, and long retention. Almost none of them have anyone assigned to look at the footage unless something has already gone wrong. Recording is a facilities function. Reviewing is a security function. When the two are owned separately, you end up with a system that documents failures beautifully and prevents none of them.
Who Should Own It
My answer is that physical security at a data center needs one accountable executive whose job includes the entire chain from the fence to the rack, and that person should not be the CISO unless the CISO has the time and the background to do it properly. Most do not, and that is a fair statement rather than a criticism. A CISO who is fighting ransomware and managing a vulnerability program does not have room to run guard operations, audit badge holders, and test the mantrap. The role needs a physical security professional with executive standing, and in a mid-sized operator that is often best served by a part-time executive security director rather than a full-time hire.
Wherever the role sits, the test is whether that person can change things. Can they rewrite post orders without asking facilities for permission? Can they revoke a badge without a ticket to IT? Can they pull footage and act on what they see? Can they tell a customer auditor directly what the program does and does not do? If the answer to those questions is no, you have a coordinator, and coordinators do not close leadership gaps.
What to Do This Quarter
Start by writing down, on one page, every physical security function in the facility and the name of the person who owns it today. Guard force, access control administration, badge issuance and revocation, visitor management, escort policy, camera review, key control, incident response, and the compliance evidence for all of the above. Where two names appear for one function, or no name appears, you have found a gap. Most operators find several on the first pass.
Next, run a full access review before you do anything else. Pull the complete list of active credentials for every layer and compare it against the list of people who currently have a business reason to hold them. Include your own employees, your customers’ staff, your contractors, and your vendors. Then walk the floor at shift change and watch whether escorts are actually assigned, whether the mantrap is actually enforced, and whether the guard checks the credential or waves at the face. None of this requires new equipment. It requires someone whose job it is to look.
Finally, assign the role. Name one person, give them authority over the whole chain, and have them report to the COO or the CEO rather than to a department that owns only one piece. If you do not have that person on staff and cannot justify a full-time executive, bring one in fractionally. The doctrine I built my career around is that security should be tested rather than assumed, which I lay out in Until Tested: Security Is Only Assumed, and a program with no single owner cannot be tested because nobody has the standing to run the test.
Go Deeper
For a full explanation of how a part-time executive security director fits into an organization like yours, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have exactly this leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply