Facility controls and capstone: server rooms, environment, fire, power and an architecture review

The final lesson completes sub-domain 3.9, designing site and facility security controls, and then pulls the whole domain together in a capstone architecture review. Lesson 11 covered the outer layers of a site. Here we move inside, to wiring closets, server rooms and data centers, media and evidence storage, and the utilities and environmental systems that keep equipment running: heating, ventilation and air conditioning, humidity control, water detection, fire detection and suppression, and power. These controls protect availability as much as confidentiality, and many questions about them test whether you put people first and choose controls that fit the risk.

Wiring closets, server rooms and data centers

Wiring closets, also called intermediate distribution frames, hold switches and patch panels that connect each floor. They are often neglected: unlocked, shared with cleaning supplies, or used as storage. Anyone with access can plug in a rogue device, tap traffic or simply unplug the network. They should be locked, access-controlled and logged, with no shared use, and with cabling protected from tampering. The main distribution frame and the server room deserve stronger controls still.

Server rooms and data centers should be in the building interior, away from exterior walls, windows, roofs, basements prone to flooding, and spaces directly below water sources such as kitchens or washrooms. They should have a single primary entrance with strong access control, such as badge plus biometric or PIN, and a mantrap for larger facilities; any other doors should be emergency exits only, alarmed and without exterior hardware. Walls should run from the true floor to the true ceiling, not just to a drop ceiling, so that nobody can climb over from the next room. Raised floors and overhead trays carry cabling and sometimes cooling. Inside, equipment is often in locked racks or cages, especially in shared colocation facilities, and cameras watch the entrance and aisles. Visitors and contractors are escorted and logged. Two-person rules may apply to the most sensitive areas.

Media and evidence storage

Backup media, spare drives and paper records need secure storage that protects them from theft, unauthorized access and environmental damage. Media libraries use locked cabinets or rooms with check-in and check-out logs, often managed by a media librarian. Off-site storage for backups must be secured in transit and at the vendor, with documented chain of custody. Media safes are rated for the temperatures that matter: paper chars at around 177 °C or 350 °F, but magnetic and optical media can be damaged at much lower temperatures, around 52 °C or 125 °F, so data-rated safes keep their interiors cooler for a stated time. Evidence storage for investigations needs even stricter controls: restricted access, logs recording every person who handles each item, tamper-evident packaging and protection of integrity, so that evidence remains admissible. These topics link to domain 2 on asset handling and domain 7 on investigations.

Restricted and work areas

Beyond the data center, organizations have other restricted areas, such as executive offices, research labs, cash handling and areas processing classified or highly sensitive information. Controls include clean desk policies, locking cabinets, privacy screens, visitor escorts and badges that show access levels visually. Secure rooms for classified discussions may need sound masking, shielding and inspection for listening devices. Shielding against emanations, known as TEMPEST in government settings, prevents electromagnetic signals from equipment being captured outside; it uses Faraday cages, shielded cables and controlled distances, and is used mainly for high-security government work. Work-from-home staff extend the facility into homes, so policies cover screen privacy, locked storage for paper and secure disposal.

Heating, ventilation and air conditioning

Electronic equipment turns almost all the electricity it uses into heat, so cooling is critical. ASHRAE, the American Society of Heating, Refrigerating and Air-Conditioning Engineers, publishes widely used thermal guidelines for data processing environments through its technical committee TC 9.9. The recommended range for air entering most IT equipment is 18 to 27 °C, about 64 to 81 °F, with wider allowable ranges for equipment classes designed to tolerate them. Running warmer within the recommended range saves energy. Older guidance and many exam materials quote narrower targets, so focus on the principle: keep inlet temperatures within the manufacturer's and ASHRAE's ranges and monitor them continuously.

Hot aisle and cold aisle layouts arrange racks in rows facing alternately, so that equipment draws cool air from a shared cold aisle and exhausts hot air into a shared hot aisle. Containment, enclosing either aisle with doors and roofs, stops hot and cold air mixing and improves efficiency. Positive air pressure keeps the room at slightly higher pressure than surrounding spaces, so that when doors open, air flows out, carrying dust and smoke away rather than pulling it in. HVAC systems should be dedicated to the data center where possible, with redundant units, and should shut down or switch modes automatically when fire is detected, so that they do not feed a fire or spread smoke, depending on the suppression design.

Humidity matters too. Air that is too dry encourages static electricity, which can damage components; static discharges of a few thousand volts are common and imperceptible to people yet can destroy sensitive circuits. Air that is too moist causes condensation and corrosion. ASHRAE now expresses its recommended range mainly in terms of dew point, with a lower limit of about −9 °C dew point and an upper limit of about 15 °C dew point and 60 percent relative humidity, while many study guides still quote 40 to 60 percent relative humidity as a simple target. Antistatic flooring, wrist straps and proper grounding add protection. Water detection sensors under raised floors and near cooling units give early warning of leaks.

Fire: prevention, detection and suppression

Fire needs heat, fuel and oxygen, plus a chemical chain reaction; removing any of these, often shown as the fire tetrahedron, puts a fire out. Prevention comes first: keep combustible materials out of the data center, maintain electrical systems, ban smoking and train staff. Detection comes next. Smoke detectors, either ionization or photoelectric, respond early; heat detectors respond to a fixed temperature or a rapid rate of rise but are slower; flame detectors sense infrared or ultraviolet light; and very early smoke detection apparatus, VESDA or aspirating systems, continuously sample air and detect tiny amounts of smoke long before conventional detectors. Detection systems connect to alarms, notify the fire department and trigger suppression and HVAC shutdown.

Fires are classified by fuel, and the classes differ slightly between countries, which matters for choosing extinguishers. Portable extinguishers let trained staff put out small fires; larger fires call for evacuation.

Fixed suppression systems protect rooms automatically. Water sprinklers remain the most common and are required by code in many buildings. Wet pipe systems hold water in the pipes at all times and discharge as soon as a sprinkler head's bulb or link melts; they are simple and reliable but risk leaks. Dry pipe systems hold pressurized air until a head opens, then admit water; they suit unheated spaces where pipes could freeze but respond more slowly. Pre-action systems require two events, typically a detector alarm that fills the pipes and then a sprinkler head opening, which greatly reduces the risk of accidental discharge, so they are the usual sprinkler choice for data centers. Deluge systems have open heads and release large volumes over a whole area at once, for high-hazard spaces such as aircraft hangars or chemical storage, not for computer rooms.

Gaseous systems put out fires without water and leave no residue, protecting equipment. Inert gas systems such as those using nitrogen, argon or blends like IG-541, often sold as Inergen, reduce oxygen to a level that stops combustion but still allows people to breathe for a short time. Halocarbon clean agents, such as HFC-227ea, often sold as FM-200, and FK-5-1-12, sold as Novec 1230, work mainly by absorbing heat. Halon, once standard, is banned from new production under the Montreal Protocol because it depletes ozone, though existing systems remain in limited use. Carbon dioxide systems are effective but lethal at extinguishing concentrations, so they are used only in unoccupied spaces with strict lockout and warning procedures. Clean agent systems are designed under NFPA 2001 and require sealed rooms so that the agent holds its concentration. The landscape keeps changing: 3M ended production of Novec 1230 by the end of 2025 as part of its exit from PFAS chemicals, although other manufacturers make FK-5-1-12, and regulations phasing down hydrofluorocarbons affect FM-200. Many data centers combine pre-action sprinklers, which codes often require, with a clean agent system for faster, cleaner response.

In the United States, fire protection requirements come from the codes adopted by each state and city, usually the International Fire Code or NFPA 1, together with NFPA 13 for sprinklers, NFPA 72 for fire alarm and signaling, NFPA 2001 for clean agents, NFPA 75 for IT equipment and NFPA 76 for telecommunications facilities. The Environmental Protection Agency regulates halocarbon agents under the Clean Air Act and the AIM Act's phase-down of hydrofluorocarbons.

Power

Equipment needs clean, continuous power. Problems include blackouts, total loss of power; brownouts or sags, low voltage; spikes and surges, momentary or prolonged high voltage; faults, brief losses; and noise or interference from electromagnetic and radio-frequency sources. Surge protectors and line conditioners handle surges and noise. Uninterruptible power supplies, UPSs, use batteries to bridge short outages and to give time for generators to start or systems to shut down cleanly. Online or double-conversion UPSs constantly run the load from the battery-backed inverter, giving the cleanest power; line-interactive and standby units switch over when power fails. Generators, usually diesel or natural gas, provide long-term power and start within seconds; they need fuel supplies, regular testing under load and maintenance. Larger sites use dual utility feeds from separate substations, automatic transfer switches, power distribution units with monitoring, and redundancy designs such as N+1, where one extra component covers any single failure, or 2N, with complete duplicate systems. The Uptime Institute's tier classification, from Tier I basic capacity to Tier IV fault tolerant, describes increasing levels of redundancy.

load_kw = 12
battery_kwh = 20
efficiency = 0.94
runtime_h = battery_kwh * efficiency / load_kw
print(f'UPS runtime: {runtime_h:.2f} h = {runtime_h*60:.0f} min')
for hours in (24, 48, 72):
    fuel_l = load_kw * hours * 0.27
    print(f'{hours} h on generator: {fuel_l:.0f} L diesel ({fuel_l/3.785:.0f} US gal)')

UPS runtime: 1.57 h = 94 min
24 h on generator: 78 L diesel (21 US gal)
48 h on generator: 156 L diesel (41 US gal)
72 h on generator: 233 L diesel (62 US gal)

Capstone: an architecture review

Domain 3 asks you to see a system as a whole. Consider a regional health clinic network moving its patient records system to a new design: a web application in a public cloud, a small server room at head office for imaging, clinics connecting over the internet, and medical devices in each clinic. A security architect reviewing the design would work through the domain in order.

First, the principles from lessons 1 and 2. Threat modeling with a data flow diagram shows patient data crossing from clinics to the cloud, from devices to clinic networks and from staff to administrative interfaces; STRIDE applied to each flow identifies spoofed logins, tampered records and disclosure of health information. Least privilege limits staff to the records they need; separation of duties keeps administrators from approving their own access; zero trust replaces trust in the clinic network with per-request checks of user identity, device health and context; privacy by design minimizes the data replicated to clinics; and the cloud shared responsibility model clarifies that the clinic owns identity, data and configuration. Second, models and evaluation from lessons 3 and 4. Clark-Wilson style controls protect the integrity of prescriptions through well-formed transactions and separation of duties; the cloud service's authorization and the medical devices' certifications are reviewed, and residual risk is accepted formally by an authorizing official.

Third, platform capabilities and vulnerabilities from lessons 5 to 7. Servers use secure boot and TPM-backed attestation; keys live in a cloud key management service backed by HSMs. The web application is reviewed for injection and access control flaws, the database for inference and aggregation risks, and the medical devices are segmented as an industrial-style network with no direct internet access. Cloud configurations are checked continuously, containers are scanned and run with minimal privileges, and IoT devices get unique credentials and patch plans. Fourth, cryptography from lessons 8 to 10. TLS 1.3 protects data in transit; AES-256 in GCM mode protects stored records; signatures protect software updates; PKI with short certificate lifetimes and automation handles device and server certificates; and a cryptographic inventory feeds a post-quantum migration plan that prioritizes long-lived health data against harvest-now-decrypt-later attacks. Fifth, facilities from lessons 11 and 12. The head office server room is in the building interior with badge and PIN entry, cameras, positive pressure, ASHRAE-range cooling, water detection, pre-action sprinklers with a clean agent system, a UPS sized for generator start-up and a generator with fuel for several days.

Finally, the architect prioritizes. Not every gap is equally serious, and budgets are finite. Risks to patient safety and large-scale disclosure come first, such as unsegmented medical devices and missing multifactor authentication for remote administration; then integrity risks to records; then longer-term work such as post-quantum readiness. The review ends with a report to management that explains risks in business terms, proposes options with costs, and records decisions, which is the managerial perspective the CISSP exam rewards throughout.

Thinking like a manager

For facility questions, remember the priorities: people first, then preventing incidents, then detecting and containing them. Choose pre-action sprinklers or clean agents for data centers, not deluge; never water on energized electrical fires; carbon dioxide only where nobody can be present. Size UPSs to bridge the gap to generators and test generators under load. And in any architecture review, work systematically through the domain, then prioritize by risk and communicate in business terms.