Skip to main content

Pro audit program · v1.0

Datacentre Access Walkthrough

If you have on-prem racks anywhere, walk the physical security controls — badge access, CCTV, environment, visitor log.

  • General target area
  • ISO 27001 framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

If you have on-prem racks anywhere, walk the physical security controls — badge access, CCTV, environment, visitor log.

Risks addressed

  • High Ex-employee badge still works
  • High Server room temperature / smoke not alerted on
  • Medium Visitor logs not reconciled with actual entries

Controls (6)

  1. Badge access list reviewed monthly

    High

    This control requires a designated security or facilities management team to conduct a monthly review of all active badge access permissions across physical facilities. The review verifies that badge holders still require access based on current job roles, employment status,…

    How to test + evidence

    Testing procedure: Access list compared against HR list; deviations actioned.

    Evidence to collect: Last review report.

  2. CCTV coverage of all entry points

    High

    This control requires the deployment of closed-circuit television (CCTV) cameras positioned to capture visual footage of all physical entry points to facilities housing information systems and sensitive data. Cameras must provide sufficient coverage, resolution, and lighting to identify individuals and…

    How to test + evidence

    Testing procedure: Cameras cover doors + racks; 30+ days retention.

    Evidence to collect: CCTV map + retention setting.

  3. Environmental monitoring + alerting

    High

    Environmental monitoring and alerting systems continuously collect and analyze physical and logical infrastructure telemetry to detect anomalous conditions that could indicate security incidents, operational failures, or infrastructure compromise. These systems measure temperature, humidity, power, physical access events, fire suppression status,…

    How to test + evidence

    Testing procedure: Temp / humidity / smoke alerts to on-call.

    Evidence to collect: Monitoring config + last alert.

  4. Visitor escort + sign-in

    Medium

    Visitor escort and sign-in controls require that all non-employees entering secure facilities be registered at reception, issued temporary identification, and accompanied by authorized personnel throughout their visit. The system typically includes a visitor log (physical or electronic), badge issuance process,…

    How to test + evidence

    Testing procedure: Visitors signed in, badged, escorted at all times.

    Evidence to collect: Visitor log sample.

  5. Tailgate detection at entry

    Medium

    Tailgate detection at entry is a physical security control that prevents unauthorized individuals from following authorized personnel through access-controlled entry points without proper credential verification. This control typically employs sensors, cameras, weight detection systems, or mantrap configurations to identify when…

    How to test + evidence

    Testing procedure: Anti-tailgate doors / mantrap for sensitive areas.

    Evidence to collect: Physical control description.

  6. Annual physical security review

    Low

    An annual physical security review is a scheduled, systematic assessment of all physical controls protecting facilities, data centers, server rooms, and network equipment against unauthorized physical access and environmental hazards. The review evaluates the effectiveness of access controls, surveillance systems,…

    How to test + evidence

    Testing procedure: Documented walkthrough at least annually with findings + actions.

    Evidence to collect: Last review report.