Data center physical security assessment
Data center physical security is reviewed on paper every year and tested by almost nobody. We test it the way an intruder or a disgruntled contractor would: the loading dock, the mantrap, the cage next to yours, and the drive that leaves the building in a box.
Who it is for
- Colocation and wholesale operators preparing for customer audits, or wanting an independent view before one.
- Enterprise tenants who need to know their cage is actually theirs.
- Companies with on-premises server rooms and network closets in shared offices.
- Teams with SOC 2 CC6.4, ISO 27001 A.7 or PCI DSS Requirement 9 in scope.
What we assess
- Perimeter, vehicle approach, shipping and receiving, and the loading dock.
- Lobby and visitor process: identity checks, escort rules and whether the visitor log means anything at an incident review.
- Mantraps, turnstiles, anti-passback and tailgating, tested rather than observed.
- Cage and cabinet separation, rack locks, and the key that several customers share.
- Credentials: card and reader technology, clone exposure and biometrics. See MIFARE Classic vs DESFire vs SEOS.
- Remote hands, contractors and deprovisioning: whether access ends when the contract does.
- Chain of custody: media handling, decommissioning and destruction, from the rack to the shredder.
- The security operations center: camera coverage and retention, alarm handling and response times.
What you receive
- Findings mapped to SOC 2 CC6.4, ISO 27001 A.7 and PCI DSS Requirement 9 where they apply.
- Every finding prioritized, with a price range, naming the technology or process to move to.
- On site in daylight and after hours, plus a review of access records and vendor contracts.
- A re-test once the fixes are in.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four days on site per facility, with the report two weeks after the visit.
Common questions
We are a tenant. Can you assess the operator’s controls?
Within what your contract and the operator allow. We review the operator’s own assurance reports, test everything you control directly, and agree any testing of shared areas with the operator in advance.
Is this a SOC 2 or ISO 27001 audit?
No. We test the physical controls those audits rely on and map each finding to the control it affects. We are not your auditor and issue no attestation.
Do you test after hours?
Yes. Night shifts, weekend staffing and the contractor who arrives at 2 a.m. are where most gaps are found.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Data centers
We reply within one business day.
Nothing you send is shared outside Calibre.