The risk profile of a data centre construction project changes as the project progresses.
The closer the site gets to becoming operational, the less security is about the value of what might be stolen—and the more it becomes about time, access and keeping the project on schedule.
“It is only once the servers are up and running that the data centre starts generating revenue. That is why everything is about getting into production as quickly as possible,” says Søren Schultz from Securitas.
For the past eight years, he has specialised in data centre security and advised on securing data centres.
A delay can therefore prove far more costly than the equipment that disappears.
And that is exactly why security needs to evolve through the three phases of construction.
Phase 1: Laying the foundations
The first phase involves groundworks and excavation.
At this stage, there is relatively little valuable equipment on site. However, this is when the foundations for the security setup are established.
Access management, registration and logging need to be in place before the site grows in scale and complexity.
Phase 2: High-value assets move in
As the project moves from groundworks to construction, network equipment, copper and other valuable technology arrive on site.
Theft and fire protection become real concerns.
But if equipment disappears or is damaged, the loss is not merely financial. Installations are delayed, and the entire project schedule can be affected.
Phase 3: “Early turnover”
The production environment is established and the network is built out.
There may not yet be customer data in the facility, but the infrastructure is being prepared for operations.
“If an electrician enters the wrong room and switches off the wrong network switch, they can lose what has already been configured and set the network build several weeks back,” says Søren Schultz.
The risk is therefore not necessarily sabotage. It may just as easily be the result of an unintended action.
Uptime Institute estimates that human error plays a role in around two-thirds of data centre outages—often because procedures are not followed.
That is why access control is not simply about keeping unauthorised people out.
It must ensure that the right people have access to the right areas at the right time.
How much security is enough?
“It is a concentric approach with different layers of protection. The question is how much delay you can build in, where your detection zones are before an unauthorised person gets inside, and whether you have enough time to respond,” says Søren Schultz.
If the data hall is on the tenth floor, it takes time to reach it. In that situation, a mobile security patrol may be sufficient.
If the facility is more exposed or accessible, permanent on-site guarding may be necessary.
On a construction site, the equation changes as the project progresses.
More people have a legitimate reason to be there, while access requirements become increasingly specialised.
“Security needs to evolve with the construction project—from controlling an empty construction site to protecting a production environment that is about to start generating revenue,” says Søren Schultz.
BREAKING