If you have been through a customer audit, you have been asked how often data center access permissions are reviewed, and you probably answered quarterly because that is what the auditor expected to hear. The honest answer in most facilities is that a review happens when an audit is coming, and the review consists of someone in access control exporting a list and someone else signing it. That satisfies the control. It does not tell you whether the people on the list should still be able to open a cage door.
I want to give you a better answer than a single number, because the right cadence depends on which layer you are talking about, who holds the credential, and what triggers a change. A fence badge held by a long-term employee and a cage credential held by a contractor’s subcontractor are not the same risk and should not be reviewed on the same schedule. What follows is the approach I use when I look at an operator’s program, and it will hold up better in front of an auditor than a reflexive quarterly.
Why Quarterly Is Not Enough on Its Own
A quarterly review means a credential that should have died on the first day of the quarter stays alive for up to ninety days. In a data center that is ninety days of a former contractor, a reassigned technician, or a customer’s departed engineer being able to walk through the mantrap and into a cage. The review catches the drift eventually, and eventually is the problem. Access permission drift accumulates between reviews, and the review only ever resets the clock.
Periodic review is also only as good as the reviewer. When the export goes to a department head with two hundred names on it and a request to confirm by Friday, the department head confirms all two hundred, because confirming is easy and investigating is not. I have seen reviews signed off that included people who had left the company a year earlier, because the reviewer was looking for names they did not recognize rather than for names that should not be there. A schedule without a method is a ritual.
Review on Events First, Then on a Calendar
The strongest programs review access when something changes, and use the calendar as a backstop for what the event process missed. The events are predictable: an employee separates or changes roles, a contractor’s purchase order closes, a customer notifies you of a staffing change, a project ends, a vendor’s maintenance agreement expires. Every one of those should generate a same-day access change without waiting for anyone to think of it. If your program depends on someone remembering to tell security, the event process does not exist and you are running on the calendar alone.
The calendar review then has a different job. It is there to catch the cases where the event never reached security, and to force a fresh justification for every credential rather than a rubber stamp. Done that way, the calendar review is a test of the event process. If the calendar review finds a lot of stale access, the event process is broken and that is the finding, more than any individual badge.
A Cadence That Matches the Layers
Here is the cadence I recommend for a mid-sized operator, and you should adjust it to your own risk rather than treat it as scripture. Cage and rack level credentials, which put a person in physical reach of customer equipment, should be reviewed monthly, and every credential should carry a named sponsor who reaffirms the need. Contractor and vendor credentials at any layer should carry an expiration date set from the statement of work and should never be extended without a fresh request, which means they effectively review themselves. Customer-issued cage access should be reconciled with each customer at least quarterly, in writing, because their staffing changes live in a system you cannot see.
Employee credentials for the outer layers, the fence, lobby, and general floor, can run on a quarterly review if your event process for separations and role changes is proven. Guard force credentials should be reconciled with the contract company’s roster monthly, because turnover in that population is high and their access is broad. And once a year someone should do a full reconciliation of every layer against every source of truth, including HR, procurement, customer records, and contractor rosters, looking specifically for credentials that no source can explain.
What a Real Review Looks Like
A real review starts with the full list of active credentials for the layer in question, not a list of people. The distinction matters because one person may hold several credentials and a review of people misses the extra badge that was issued for a project and never collected. Each credential is matched to a current business reason and a named sponsor, and any credential that fails either test is disabled first and questioned later. Disabling is reversible in minutes. A stale credential that gets used is not.
The review also looks at use. A credential that has not been presented at any reader in ninety days is almost certainly no longer needed, whatever the sponsor says, and a credential that is being used at doors unrelated to the holder’s job is a question for the holder. Finally, the review should be tested rather than trusted. Take a credential you know has been revoked and walk it to a cage door. If the door opens, your review process and your revocation process are both broken, and you learned that for the cost of a ten-minute walk.
Who Should Own the Review
In most data centers the review is owned by nobody in particular. Access control administration sits in IT or facilities, the sponsors sit in operations, the customers sit outside the building, and the CISO signs the attestation. The review needs a single owner with the authority to disable credentials without a ticket and the standing to push back on a sponsor who reaffirms everyone by default. That is a security leadership function, and if you do not have a security leader with that authority, a part-time executive security director is often the right way to get one.
Start this week by pulling the full credential list for your cage layer and matching every entry to a sponsor and a reason. Then write down how a separation, a closed purchase order, and a customer staffing change each reach security today, and test each path with a real case. The doctrine I built my career on is that security should be tested rather than assumed, which I lay out in Until Tested: Security Is Only Assumed, and an access review that has never been tested against a revoked badge is exactly the kind of assumption I mean.
Go Deeper
For a full explanation of how a part-time executive security director fits into an organization like yours, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have exactly this leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply