The Alert That Arrived During a Lockdown
You are the on-call security operations lead at a 900-person office campus. At 10:15 a fire alarm triggers a full evacuation. At 10:19, while 700 people are standing in the assembly area and the fire service has not yet arrived, your monitoring platform raises a high-severity alert: an unauthorised access attempt at the data centre door on the ground floor, badge rejected twice, then held open. The data centre is inside the evacuated building. You have two guards on site, both currently managing the assembly point. The fire alarm has not been confirmed as false. Your incident log system is available; the site manager is unreachable.
1. What do you do in the first ten minutes, and how do you sequence competing priorities?
Read the worked answer
The trap here is treating this as a choice between 'fire' and 'intruder.' It is a sequencing and information problem under uncertainty.
First ten minutes:
- Confirm what you can from where you are. Pull the data centre door camera and access log remotely. Is the door actually open? Is anyone visible? The alert says 'held open' - verify before committing people.
- Do not strip the assembly point. 700 evacuated people with no fire service on scene is itself a life-safety situation. Sending both guards into an unconfirmed-fire building is unacceptable risk.
- Contact the fire service ETA and the building's fire marshal - they may already be inside and can check the door.
- Send one guard, not two, only if the door is confirmed open and the fire alarm is confirmed false or the fire service is on scene. Otherwise keep guards at the assembly point and use remote monitoring plus the fire crew.
- Lock down remotely. Disable the badge, trigger the door's fail-secure override if safe to do so, and preserve the access log.
- Log everything in real time - timestamps, decisions, who authorised what.
Model answer: verify remotely, protect the life-safety priority, use the fire service as your inside resource, commit a guard only on confirmed information, and document.
2. The fire alarm turns out to be a burnt toast incident, but by then the data centre door has been open for 14 minutes and the badge belongs to a contractor who left the company three weeks ago. What are the priority actions and the reporting obligations?
Read the worked answer
Now you have a confirmed security incident with a 14-minute exposure window and a deprovisioning failure.
Priority actions:
- Contain: confirm the door is secured, the badge is disabled, and the contractor's access is fully revoked across all systems.
- Preserve evidence: access logs, CCTV, door controller logs, and the alarm timeline - before retention windows or shift changes erode them.
- Establish what was accessed: physical walkthrough of the data centre, rack-level checks, and reconciliation against asset records. An open door is not the same as a compromise, but you must be able to say which.
- Root cause: why did a former contractor's badge still work three weeks after departure? This is a leaver-process failure, likely systemic.
- Reporting: notify the site manager and, per policy, the data protection officer if personal data could have been accessed; notify the contractor's former employer if relevant; prepare an incident report. Check whether regulatory breach-notification thresholds apply - do not decide that alone.
- Corrective action: audit all leaver access revocations, not just this one.
Model answer: contain, preserve, scope, root-cause, report through the correct channels, and fix the systemic gap.