In a data center the security question is unusually precise: who physically reached which rack, and when. Video is one of the few controls that can answer it after the fact, and it is routinely specified as though the building were an office with expensive contents.
The problem in this industry
Physical access is a security control, and it has to be reviewable. NIST SP 800-53 control PE-6 requires an organization to monitor physical access to the facility where the system resides in order to detect and respond to physical security incidents, to review physical access logs at an organization-defined frequency, and to coordinate the results of those reviews with incident response. Its discussion names the methods: "the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices."
Your customers inherit their obligations to you. A colocation or managed hosting provider is holding other organizations' systems, and their rules follow the equipment. A healthcare customer, for instance, must implement facility access controls, "policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed." If those systems sit in your building, your controls are how that customer satisfies theirs, and they will ask you to evidence it.
The interesting areas are small and busy. Cage doors, rack rows, mantraps, loading bays and the roof or yard where plant sits. Contractors, engineers and customer staff move through them continuously, all legitimately.
Nobody is standing there. Data halls are frequently unstaffed for long periods, and OSHA lists working alone or in isolated areas, and working late at night, among the factors that raise risk for staff.
How the capability applies
- Design around access points, not floor area. Every controlled door, mantrap, cage entrance and aisle end. A camera per data hall is coverage; a camera per cage row is evidence.
- Pair every camera with the access event. The badge record says who was authorized, the footage says who came through and how many. Together they satisfy the log review PE-6 asks for. See video surveillance and access control.
- Specify for recognition at cage and rack level. The purpose is to identify a person at a specific rack, not to observe activity in a hall. That determines lens, distance and mounting, and it is where most designs are too ambitious with too few cameras.
- Set retention against audit cycles. Customer audits and incident investigations frequently look back further than an operational incident would. Retention is organization-defined, so decide it against the longest review you are contractually exposed to.
- Do not let the surveillance system be the weak system. Cameras on their own segment, unique credentials, current firmware, no recorder reachable from the internet. In a facility selling security assurance, an unmanaged camera network is an awkward finding. See video surveillance security and risk.
- Add sensors where cameras cannot look. Door contacts and environmental sensors alongside cameras, so events prompt review rather than review depending on someone watching. That pairing is the subject of video surveillance and intrusion detection.
What changes
Customer audits get shorter. When an auditor asks how physical access to a cage is controlled and monitored, you produce the access log, the footage and the review record together. The alternative is a day of explanation.
Access reviews become real. PE-6 asks for logs to be reviewed and the findings coordinated with incident response. With video attached, review means looking at what happened rather than reading a list of badge numbers.
Contractor work becomes accountable. Engineering visits, hardware swaps and cable work are recorded against the cage they touched, which settles most questions about what changed and when.
Selling gets easier. Physical security is on every colocation due diligence questionnaire. Being able to describe camera coverage at cage level, retention, access control to footage and the review cycle is a commercial asset as much as a control.
LABUSA designs surveillance for data centers and IT facilities alongside the access control and cabling it depends on. See our data centers and IT facilities industry page, or request a free site security assessment. To turn findings into a funded sequence, see building a roadmap, and for what we install our video surveillance solutions.
Sources
- National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. Establishes control PE-6, its requirements to monitor physical access, review physical access logs at an organization-defined frequency and coordinate results with incident response, and the quoted discussion naming guards, video surveillance equipment and sensor devices. nvlpubs.nist.gov. Accessed 18 August 2026.
- Electronic Code of Federal Regulations, 45 CFR 164.310, Physical safeguards. Establishes the quoted facility access controls standard that a healthcare customer must satisfy, and which a hosting provider is asked to support. ecfr.gov. Accessed 18 August 2026.
- Occupational Safety and Health Administration, Workplace Violence. Establishes the quoted risk factors of working alone or in isolated areas and working late at night. osha.gov. Accessed 18 August 2026.