If you operate a mid-sized data center or a handful of colocation sites, you probably have every physical security component a customer would expect to see. You have a guard force, a layered access control system, biometric readers at the cage, cameras with long retention, and a visitor management process that produces a log for the auditors. What you may not have is a person whose full job is to lead all of it. That is the data center security leadership gap, and in my experience it is the most common and least discussed weakness in the industry.
The gap is easy to miss because everything appears to be running. Doors lock, badges beep, footage records, and the SOC 2 report comes back clean. But running is different from being led. Led means someone is deciding what the program should do, checking whether it does it, and changing it when the business changes. In most operators of this size nobody holds that job, and the absence shows up only when a customer auditor asks a question nobody can answer or when a contractor’s badge is found still active a year after the contract ended.
What the Data Center Security Leadership Gap Looks Like
The pattern is consistent. The large hyperscale operators have a full physical security organization with a director, regional managers, and a dedicated investigations function. The smallest operators have an owner who knows every person on the floor by name and handles security personally. The operators in between, with a few facilities and a few hundred customers, have grown past the point where the owner can do it and have not reached the point where a full-time security executive seems affordable. So the work gets split among people who have other jobs.
The facilities director manages the guard contract because it came with the building. The IT team administers the badge system because it runs on the network. The CISO owns the compliance attestations and answers the auditors, while spending nearly all of their time on network threats. Each of them does their piece competently, and none of them has the time, the mandate, or the background to look at the program as a whole. That is what a leadership gap is. It is a set of capable people, none of whom is responsible for the outcome.
The Failures the Gap Produces
Access permission drift is the first and most reliable symptom. Credentials get added quickly, because customers and projects need access and nobody wants to be the bottleneck. Credentials get removed slowly or never, because removal requires someone to know that a person has left and to care enough to act. Over a few years the number of active badges grows well past the number of people with a current reason to hold one, and the biggest share of the excess belongs to contractors and vendors, who are the largest population of non-employees in any data center.
Policy erosion follows. Escort requirements are written clearly and enforced loosely, because the guards know the regular vendors and the floor is busy. Tailgating through the mantrap becomes normal during shift changes. Cameras record everything and nobody reviews anything, so the deterrent value of the system quietly disappears while the recording keeps running. Insider threat gets no attention at all, because nobody owns it and the people best placed to notice a problem, the shift supervisors and the guards, have no one to report it to who would act. None of these failures is dramatic. All of them are the kind of thing a customer auditor eventually finds, or a determined person eventually exploits.
Why a Full-Time Hire Is Not the Only Answer
When an operator recognizes the gap, the first instinct is to post a job for a director of physical security. That is a fine answer for a large operator. For a mid-sized one it often stalls, because the role is expensive, the candidate pool with real data center experience is thin, and the executive team has trouble picturing what a full-time person would do every day once the initial cleanup is finished. So the requisition sits open, the gap stays open, and the work stays split.
The answer I advocate is a part-time executive security director, engaged fractionally, with the authority of the role and a fraction of the cost. That person owns the program from the fence to the rack, reports to the COO or CEO, and spends their time doing the leadership work rather than the operational work. They set the standard, audit against it, hold the guard vendor to the contract, run the quarterly access review, answer the customer auditors, and test the controls. The guards, the badge administrators, and the facilities team keep doing what they do, but now they do it under someone who is accountable for whether it works.
How to Tell Whether You Have the Gap
Ask three questions of your own organization. First, who can tell you today how many active credentials exist across every layer of your facilities and how many of them belong to people no longer under contract? If the answer requires a meeting, you have the gap. Second, when was the last time someone tested the mantrap, the escort policy, or the guard post against a person they did not recognize, and what did they find? If no one can point to a date and a written result, you have the gap. Third, when a customer auditor asks who owns physical security, does one name come out or does a list?
If those questions are uncomfortable, start with the access review, because it is the fastest way to see the size of the problem. Then decide who owns the program and give them the authority to run it. The doctrine I lay out in Until Tested: Security Is Only Assumed is that every control is only an assumption until someone verifies it, and verification requires a person whose job it is to look. Closing the leadership gap is simply putting that person in place.
Go Deeper
For a full explanation of the role, how it is scoped, and how it compares to a full-time hire or a consultant, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have this leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply