This reality, according to Johnson Controls, calls for an integrated approach of both cyber and physical security for data centres, and it should start with the physical space itself - a space that houses thousands of servers, storage systems, networking systems and potentially high-value or sensitive data. For that reason, when it comes to a data centre’s long-term viability and resilience, physical security is paramount. It is even intrinsically linked to online protection. In fact, according to the “IBM Cost of Data Breach Report 2025,” nearly 1 in 10 data breaches start with a physical security compromise.

While having a robust cybersecurity strategy is vital for protecting these critical environments, a comprehensive physical security programme must be designed, implemented, monitored and managed. The servers, the data they process and the buildings that house them need to be protected from physical threats such as break-ins, vandalism, arson, theft of sensitive information or unauthorized access to high-risk areas.  Below Johnson Controls shares advice on enhancing data centre security, identifying the key challenges and offering a 5-layered strategy solution.

Addressing the security challenges of a modern data centre

As data centres have increased in scale and complexity, so too have the physical security challenges that go along with them. While effective management of insider and outsider threats remains a top priority, today’s expectations demand solutions that allow security operators to spend less time on manual processes – such as threat hunting and incident forensics across multiple tools and compliance reporting – and more time on investigating prioritised incidents and executing orchestrated responses.

Given the fluctuations in size and scale of data centres, security requirements can vary widely from location to location. However, whether they are hyperscalers, colocators or large enterprises, according to the company, all data centres share some common physical security challenges.

These include:

• Optimising perimeter protection to maximize coverage and reduce false alarms
• Implementing different levels of access to staff, contractors and visitors
• Recognising and tracking vehicles, people and objects as they move around the facility to spot behavioural and occupancy anomalies – especially near core assets
• Strengthening access to high-risk areas with multi-factor authentication
• Compiling event data across security systems to effectively detect malicious behaviour

Addressing these challenges and protecting these critical facilities requires more than isolated safeguards. It demands an integrated, multi-layered approach that anticipates and helps neutralise threats before they impact operations and disrupt business continuity. Or, more specifically, an optimal facility security approach requires defence in depth.

5 essential layers of a strong, defence in depth strategy

Defence in depth is a comprehensive security strategy that uses multiple, layered security controls and technologies to protect assets at every level of data centre access.

With a layered defence in depth approach to security, data centre operators and facility managers can protect the data centre from the outside in. The approach starts at the outermost boundaries, where strong fencing controls and intelligent cameras protect the perimeter. The layered protection continues as you move inward from building and common areas to the most sensitive locations and assets. All layers are then brought together in a central security operations platform.

Below is a breakdown of the five layers of protection that are used in this approach.

1. Perimeter protection - the first line of defence

Starting at the outer bounds of a facility, the first layer of protection is where you spot potential intruders as they approach or enter the surrounding premises. Intelligent camera systems can identify and track people, objects, vehicles and license plates, while ground-based radar covers blind spots.

Together, these tools aim to provide a comprehensive view of activity around the premises. Integrated intrusion detection and access control systems further bolster this line of defence and give operators early warnings so that they can stop unauthorised access before threats reach the building.

2. Monitoring entrants to building and common areas

Once on the premises, focus shifts to providing secure building access and monitoring movement through lobbies, corridors and shared spaces. These areas act as gatekeepers to any structure, and it is no different within a data centre facility. Credential-based entry, biometric authentication and visitor management systems mean only authorised personnel can gain access to a building or common area.

Be they one-off visitors or established employees, every entrant must be accounted for at all times. Real-time monitoring and camera systems can track movement and maintain visibility of personnel throughout the facility. This is essential for spotting behavioral anomalies and suspicious activities as soon as they occur.

3. Protecting infrastructure zones and technical areas

If critical assets are held at the core of the facility, then the margin for error becomes smaller as you move inward – and the price for having a vulnerability becomes more severe. Arson, sabotage and other forms of vandalism can have a detrimental impact on operations. Even accidental damage caused by underqualified personnel can come with serious consequences.

This third critical layer includes mechanical rooms, electrical panels and network closets. These areas require restricted access protocols, environmental monitoring systems and centrally controlled electronic locks. Centralised implementations and enforcement of granular, role-based access control means that only approved staff can enter to reduce risks of both accidental breakages and malicious activities.

4. Securing high-risk areas and critical assets

The final core layer – which includes server rooms, racks and data vaults – demands the highest level of security. Multi-factor authentication, cabinet-level locking systems and continuous surveillance can safeguard your most sensitive assets.

At this layer, every access attempt is logged and alerts are triggered for unauthorised activity. This allows for rapid response and forensic analysis.

5. Bringing it all together with security operations

All components and enforcement points are centrally monitored from a security operations platform. Centralised monitoring and event correlation provide a complete picture of potential threats and allow data centre personnel to effectively orchestrate faster, more appropriate responses. This integration also simplifies compliance and audit processes, while ensuring event logs are stored for post-incident investigations.

With a robust defence in depth strategy, threats can be deterred, detected and mitigated at multiple junctures. Each layer of protection plays its own vital role in reducing risk and enhancing operational security. Each layer serves a purpose, plays a part in overcoming a specific security challenge and adds to the overall resilience of the facility. Together, each layer creates an integrated and holistic security system with overlapping protection removing any possible overreliance of a single control.