Data centre access control is the physical security layer that lets only authorised people into areas holding servers, storage and network equipment, only for as long as needed, and records every entry. A good design nests zones from the building entrance to the data hall, gives vendors time-limited access and answers an auditor's "who entered the server room?" in minutes.
Key takeaways
- Data centre access control nests zones from the building entrance to the cabinet; permissions narrow from the outside in.
- Permanent access goes only to the few people who enter the data hall every day; vendors enter with time-limited, work-order-based access.
- An ISO/IEC 27001 auditor wants to see who is authorised for which area, how permissions are granted and withdrawn, and the entry records.
- According to the Verizon 2026 DBIR, breaches involving a third party reached 48% of the total; maintenance crews and vendors fall into that group.
- SmartPass, developed by Digital Bridge, logs every refused entry with its reason and every permission change with its previous and new value.
Some of the most expensive gaps in cyber security start behind a door; the digital-side controls are collected in our SME cyber security checklist. This guide covers layered zone design, a six-step framework, what an ISO 27001 audit expects and a maintenance visit walked through step by step; factory, hospital and school scenarios are in our access control and attendance hub.
What are the most common server room access problems?
Whether it is a large data centre or a server room in a factory basement, the picture is similar. A handful of people hold a key or card that opens the door, but nobody has the exact list of who that handful is. The air-conditioning engineer, the UPS (uninterruptible power supply) service technician, the network supplier and the telecoms operator's engineer come in dozens of times a year. Usually someone from IT opens the door and waits until the work is done, or does not.
Corporate data centres add another layer: several customers' or departments' equipment sits in the same hall. Without a record, nobody can tell which technician accessed which cabinet, whether an expired supplier's card was ever cancelled, or whether an entry at midnight was planned maintenance or a breach.
These server room access gaps become visible at audit time. Information security standards such as ISO/IEC 27001 explicitly expect physical entry controls and evidence that they work; "the door was locked" is not enough, and you need a record of who entered, when, and under what authorisation. A thorough penetration test often puts this to the test on site: if testers posing as contractors can walk up to the server room, the firewalls on the network count for much less.
What does uncontrolled data centre access cost?
Physical access gaps in a data centre become expensive in two ways: outages and data breaches.
In Uptime Institute's 2025 annual survey, 57% of respondents said their most recent major outage cost more than $100,000, and one in five reported costs above $1 million. (Uptime Institute, Annual Outage Analysis 2026)
In the same release, Uptime Institute notes that failure to follow established procedures remains the leading driver of outages caused by human error. In other words, the problem is often not the technology but the inability to make sure the right person enters the right area under the right procedure.
On the breach side, the human and third-party dimension keeps growing. According to the Verizon 2026 Data Breach Investigations Report (DBIR), the human element was present in 62% of breaches, while breaches involving a third party rose by 60% to 48% of the total. Vendors and maintenance crews entering a data centre fall squarely into that third-party category. And when a breach happens, the bill is high: IBM's Cost of a Data Breach Report 2026 puts the global average cost of a data breach at $4.99 million.
In Türkiye, the KVKK (Law No. 6698 on the Protection of Personal Data, broadly comparable to the GDPR) requires data controllers to take technical and organisational measures to keep personal data secure. A physical access record for servers holding personal data is evidence of those measures. If a breach occurs, the same record supplies what you need for a data breach notification within 72 hours.
How do you set up data centre access control? A 6-step framework
- Build layered zones. Building entrance → data centre corridor → data hall → cabinet or cage area. Each layer sits inside the previous one, and with zone-based access control permissions narrow from the outside in. We explain the role of cards, readers and controllers in our card access control system guide.
- Start from least privilege. Permanent access goes only to the few people whose job takes them into the hall every day. Everyone else, the rest of IT included, gets time-limited access on request and approval. This is the door-side version of the principle of least privilege used for IT accounts.
- Manage vendors and visitors with time-limited credentials. Give a maintenance firm a temporary card tied to the work order and limited to a date and time window, or a time-limited QR code where your system supports it, not a permanent card. Access should close by itself when the job ends.
- Prevent card sharing and tailgating. For critical areas like the data hall, consider single-person entry such as mantrap-style portals and rules that enforce the in/out sequence. Our article on anti-passback explains how sequence checking works; the same double-door and sequence logic used to prevent contamination is shown in cleanroom access control.
- Match authentication strength to the area. A card may be enough for the corridor; in the data hall, requiring card plus fingerprint is worth considering. We compare the options in fingerprint vs card vs face recognition.
- Keep the record audit-ready and review it regularly. Every permission change should be logged with old and new values, and every quarter someone should ask "does this person still need this access?". Auditors should be able to get read-only access.
Sample data centre permissions by layer
| Layer | Who enters? | Credential | Record |
|---|---|---|---|
| Building entrance | All staff, registered visitors | Card / temporary visitor card | Entry and exit |
| Data centre corridor | IT, facilities, approved vendors | Card / work-order temporary card | Entry, exit and zone |
| Data hall | Few permanent holders, approved work orders | Card + second factor | Every passage, with approval |
| Cabinet / cage | Only the relevant team | Hall access + separate rule | Person, time, area |
What evidence does an ISO 27001 audit expect for physical access?
ISO/IEC 27001:2022 gives physical security its own theme in the Annex A control list. The controls most directly linked to data centre access control are listed in the table below; for each one, the auditor looks for a written rule and a record showing that the rule is applied.
| Annex A control | Subject | Evidence to show in a data centre |
|---|---|---|
| 5.18 Access rights | Granting, reviewing and removing permissions | Approved access requests, quarterly review record, revoked access for leavers |
| 7.1 Physical security perimeters | Defining the boundaries of secure areas | Layer and zone plan |
| 7.2 Physical entry | Controlling entry to secure areas | Entry records by person, door and time; visitor and vendor records |
| 7.4 Physical security monitoring | Monitoring premises for unauthorised access | Video records, refused entries and alarm records |
In practice, the auditor picks a period and asks for a sample: "Who entered the data hall last quarter, and under which work order?" If the data centre access record answers that in minutes, the control is working; if it takes days of spreadsheet work, an audit finding is all but certain.
How does Digital Bridge deliver data centre access control?
Digital Bridge treats data centre access control as the point where physical and cyber security meet:
- Risk and current-state review. As part of our cyber security consultancy, we also assess physical access: who holds keys or cards, how vendors get in, and where the record is kept.
- Zone and rule design. We map the layers from the building entrance to the cabinet onto your facility and write down, in plain language, who may enter under which conditions.
- Hardware. We use our card access control range for door readers, turnstiles and locks, and our fingerprint access solutions where a second factor is needed. The technical feasibility study for hardware is free of charge.
- Video and environment monitoring. To keep critical doors under video watch as well, ONVIF-compatible cameras can be monitored centrally through our IP camera monitoring service. For building data such as temperature, humidity and energy, our smart building and BMS (building management system) work covers Modbus, BACnet, KNX and DALI.
- Data protection and audit. With our data protection compliance consultancy, we define how long access records are kept and who can see them.
- Written proposal and support. Scope, phases and cost are set out in writing. We work remotely and on site across all of Türkiye's provinces, with 24/7 technical support.
How do you manage a server room maintenance visit with SmartPass?
SmartPass, developed by Digital Bridge, is software that combines card access control, staff time and attendance (PDKS), visitor management and canteen management in one panel. In sensitive areas such as a data centre, what matters most is its access groups linked to zones, a logged reason for every refusal, and an audit log that keeps every change with its previous and new value. Let us walk through a UPS maintenance visit:
The day before. The IT manager pre-registers the maintenance firm's technician: first name, surname, company, host employee, purpose of visit and end time. The visit is given an access group linked only to the building entrance, data centre corridor and UPS room zones. The data hall is outside this permission.
10:05 — Arrival. The technician receives a temporary card at reception, and the host employee gets an email. The card's permissions are limited to the visit's access group and duration. Staff 13.56 MHz MIFARE cards and the visitor's temporary card are read on the same terminal and decided under the same rules, by a single decision engine on the server.
10:20 — An unauthorised door. By mistake, the technician taps the card at the data hall door. It does not open, and the refusal is logged with its reason, "no zone permission", because the card covers only the zones on the way to the UPS room. Nobody has to prop a door open for a "one-off" visit outside that scope.
Time profiles. The IT team wants the infrastructure team to enter the data hall on weekdays, and only the on-call engineer at weekends. In SmartPass a person's permissions are the union of the access groups they belong to, and each group is linked to zones with an optional weekly time profile: the infrastructure group gets the data hall with a weekday profile, the on-call group with a weekend profile. A rule changed in the panel applies at every door at once, and an unauthorised weekend tap is refused as "outside permitted hours" and logged.
14:00 — The visit ends. Once the visit's time is up, the card no longer opens any entry point and the panel raises a warning; the technician returns the card on the way out. Nobody has to remember to cancel anything.
Audit day. The internal auditor is given only the permissions they need: SmartPass has 43 separate panel permissions, and the audit log report requires its own permission. The auditor sees every data hall access from the last quarter, the refusal reasons and every change with its previous and new value. Access and audit records are linked in a hash chain, so deleting or altering a record is detected when the chain is verified.
Physical and digital access in one place. SmartPass is part of the Smart360 product family: you sign in to the panel with your Smart360 identity (SmartID), and users and roles are managed in the Smart360 customer panel. When a departing employee is deleted in Smart360, their name and personal details in SmartPass are erased and their card is cancelled.
Emergencies and live occupancy. At a SmartPass entry point in emergency mode, exits are freed, entries are closed and the organisation's notification recipients receive an email; an entry point can also be locked from the panel when needed. The dashboard shows how many staff, contractors and visitors are inside right now.
Data protection and multiple sites. SmartPass does not store card numbers: as a number is read, it is turned on the device into a one-way hash with an organisation-specific key, and only the hash and the last four digits are kept in the database. Once records pass their retention period, the fields that identify a person are deleted automatically, while counts and reports are kept. Organisations with several data centres or sites can open each one as a separate SmartPass organisation; each organisation's data sits in its own separate database, and authorised users switch between sites from the "My organisations" list without re-entering a password.
Next step: take an access inventory of your server room
Write down today, as a list, everyone who holds a key or card to your server room or data centre. Add the vendors who visited in the last three months and where those visits were recorded. If the list is longer than you expected, or the record does not exist, you know where to start.
Our article on access control system cost explains what shapes a data centre access control budget. Explore the product on our SmartPass page, fill in the quotation form to buy SmartPass, or get in touch to review physical and cyber security together.