Access control audit failures in a multi-tenant colocation hall

Ranking

1. Twelve orphaned accounts (highest). These are live credentials with no accountable holder. Likelihood of misuse is high because nobody is watching the identity, and impact is high because a badge-holder inside a hall can physically touch tenant equipment. The 12 March report is consistent with this route: an unidentified person inside a cage is exactly what a live orphaned credential produces. This finding also carries the strongest evidence, since the accounts are demonstrable.
2. Four shared cleaning badges among nine people (high). Sharing destroys attribution - the access control system will name a badge, not a person. It also means the anti-passback and mantrap controls are being defeated in practice, because a shared badge circulates and the system cannot distinguish a legitimate re-entry from a tailgate. Cleaners operate outside business hours, when the fewest people are present to observe.
3. Retention cut to 14 days without restoration (high, and it has already caused harm). This is an evidentiary control failure: the operator could not investigate a reported intrusion, which breaches the duty to tenants and undermines every other control's deterrent value. It is ranked below 1 and 2 only because it does not itself grant access - but it is the reason the other failures may go unproven.
4. Unrestricted badge for a sales engineer (medium). A clear least-privilege breach and a segregation-of-duties issue, but the individual is known, employed, and presumably escorted in customer areas. The risk is opportunistic rather than anonymous.
5. Motion-based recording (medium, enabling). Motion-triggered recording in a data hall is unreliable - a person standing still or moving slowly in a cage aisle may not trigger it, leaving gaps in exactly the footage you would need.

The pattern. Findings 1, 2 and 5 combine into a single scenario: an unattributed individual enters a hall, is not recorded, and the footage is gone before anyone asks. Risk assessment should reflect the combination, not the individual items alone.

Within 24 hours

• Disable the 12 orphaned accounts and extract an audit log of every use of each in the last 12 months; escalate any use outside the leaver's employment dates to an incident investigation.
• Reissue individual badges to all nine cleaners, with time-window restrictions and mandatory escort outside contracted hours. Withdraw the four shared badges and record the return.
• Remove unrestricted access from the sales engineer and reissue a badge limited to front-of-house and escorted customer areas.
• Acceptance: badge-to-person reconciliation report showing zero shared or orphaned credentials; signed by the security manager.

Within 7 days

• Restore retention to at least 30 days with redundant storage (RAID plus a secondary copy) and retest restore from backup.
• Configure recording to continuous for all cage-aisle cameras, with motion only for low-risk perimeter views.
• Enable door-held, forced-door and tailgate alarms at the mantrap, routed to the NOC with a defined response procedure.
• Acceptance: a live test - walk a known individual through the mantrap without a valid read and confirm the alarm is raised and logged within the documented response time; retrieve 30-day-old footage on demand.

Within 30 days

• Implement a monthly HR-to-access-control reconciliation with a named owner; target zero-day lag between a leaver's last day and credential revocation.
• Introduce quarterly access reviews signed by each hall owner, with least-privilege matrices per role.
• Add video analytics for loitering and tailgating in cage aisles.
• Acceptance: first reconciliation report with a full match, and the first signed quarterly review on file.

Within 90 days

• Tabletop and live exercise of the intrusion response procedure with a tenant representative present; document lessons and update the procedure.

Retention. Set a contractual minimum of 30 days and design to 90 days for cage-aisle and mantrap cameras. The justification is not arbitrary: intrusion and theft investigations typically surface weeks after the event - a tenant notices missing or moved equipment at the next maintenance visit, or a stock count reveals a discrepancy. The 12 March incident is the proof: the report came in after the 14-day window had closed, so the operator had no evidence and no defence. Retention should be written into tenant SLAs as a committed service level, which converts the cost from overhead into a sellable attribute of the facility.

Review process.

• Daily: NOC spot-check of a rotating sample of cameras for image quality and coverage, logged.
• Weekly: review of access alarms (door held, tailgate, forced door) with a documented disposition for each.
• Monthly: HR-to-badge reconciliation and review of contractor badge issuance.
• Quarterly: access rights review per hall, signed by the hall owner, with orphaned or excessive privileges removed.
• Annually: full physical security review against ISO/IEC 27001:2022 Annex A 7.1–7.4 and EN 50600-2-5, with the results feeding the ISMS management review.

The cost argument to management. Present it as three quantifiable items. First, contractual exposure: several tenant agreements likely already commit to a retention period, and an uninvestigable incident is a service-credit and renewal risk. Second, evidentiary value: without footage the operator cannot defend a liability claim or support a criminal referral, which shifts cost onto the operator. Third, sales value: retention and access-control maturity are asked about in every tenant security questionnaire, so restoring them removes a recurring obstacle in the sales cycle. Storage cost for 22 cameras at 1080p held for 90 days is a modest capital item compared with a single unresolved intrusion claim or a lost contract renewal - that framing, not the technical merits alone, is what secures the budget.