Physical security for data centers: access and perimeter events

Data centers are unusual in physical security: the access control is excellent, the camera coverage is dense, and the audit requirements are relentless. What is missing is almost never detection. It is the join between the badge log and the footage.

The question every audit asks

Show me who was in that hall, when, and prove it.

An access control system answers the first two precisely and the third not at all. It knows a credential opened a door. It cannot know who was holding it, whether anyone followed them in, or whether the escort stayed for the duration.

The cameras hold all of that. Assembling it by hand — export the log, find the camera, scrub to the timestamp, screenshot, repeat — is what makes audit preparation take days.

The events worth instrumenting

Not every badge read needs a picture. These are the ones that earn it.

Out-of-schedule hall access. A valid badge on a hall door outside the window agreed for that person. Legitimate most of the time, and exactly the pattern you want visibility on.

Door held open. A door past its timer on a secure aisle. Usually a cart. Occasionally a door deliberately propped. The log looks identical.

Presence in a cage or hall that should be empty. Detected from the camera rather than the door, which matters because the person may not have badged at all.

Contractor and escort movement. Whether the escorted party stayed together is not in any log. It is in the footage.

Perimeter and plant yard at night. Generator compounds, fuel stores and the site boundary, where the access system has no reach.

A camera going dark. On an estate this dense, a camera obscured or offline is an evidence gap. Finding it during an audit is the expensive way.

Why this has to run on site

Three constraints push the processing onto the floor rather than into a cloud.

Bandwidth. A facility with several hundred cameras cannot stream them off-site for analysis, and would not want to pay for it if it could.

Customer contracts. Colocation customers frequently have contractual limits on where footage of their space can go. “The appliance is in the building and nothing continuous leaves it” is an answer that survives a security review.

Dependency. Physical security that stops working when the uplink does is not physical security.

What a good workflow looks like

1. The event is raised — from the access system, or from the camera watching a marked area.
2. The frame is captured at that moment, not retrieved later.
3. Both land in one queue, where an operator acknowledges, resolves or escalates.
4. The decision is recorded against the event.
5. Frame, clip, camera, area, time and the decision stay together for the retention period your policy sets.

Step 5 is the one that collapses audit preparation, because the evidence pack is assembled continuously rather than on demand.

The preconditions nobody mentions in the brochure

The camera has to see the reader. Pairing a door event with footage works from almost any angle. Deciding whether the right person used the badge needs a camera that resolves a face at the reader. In a data center, cameras are frequently mounted high and wide for aisle coverage — excellent for presence, poor for identity. This is confirmed door by door, not assumed.

Clocks must agree. Access control and video drifting apart by seconds degrades correlation quickly. One time source across both.

Identity mapping is the real work. If you want badge-versus-person checking, the PACS user and the enrolled person have to be the same record. On a large estate that mapping is the bulk of the commissioning effort, and it is a decision with privacy implications that belongs to you, not your vendor.

Access integration is built, not bought. Reading door events needs an API, a database view or a scheduled export. Most platforms offer one. Which one, and what fields come with it, is established against your specific system during onboarding.

What to measure in a pilot

• Median time from an access exception to the relevant footage on screen.
• Hall and cage exceptions per week, and how many warranted a response.
• Which critical doors have a camera that can resolve a face at the reader.
• Time to assemble an evidence pack for a customer or certification audit.
• Operator minutes per reviewed event, before and after.

Pick one hall and the doors around it. A floor that works tells you far more than a site-wide configuration built on assumptions — and it gives you real numbers to take to the next budget conversation.