Shared-building server room and the cleaning contractor
Greenfield Data Services operates a small colocation room inside a shared office building. The room holds 18 racks, including two used by a client that processes payment-card data. Cleaning is outsourced to a contractor whose 12 staff hold building passes that also open the server-room door; the pass log is reviewed only when something goes wrong. CCTV covers the door but retention is 7 days and the camera above the loading bay has been broken since March. Last month a contractor's laptop was stolen from an unlocked meeting room, and a visitor was seen following an employee through the server-room door without badging. The facilities manager argues that the building already has a receptionist and a sign-in book, so 'physical security is covered'. The client is asking for evidence under its supplier agreement.
1. Assess the facilities manager's claim using a layered-controls argument. Identify the most serious gap.
Read the worked answer
A receptionist and a sign-in book are one layer, not a system of physical security.
Physical protection works in layers: the building perimeter, the controlled entrance, the secure room boundary, entry authentication, internal zoning, monitoring and response. The receptionist controls the building lobby; it does not control who enters the server room. The sign-in book records visitors, not the 12 cleaning staff whose building passes open the server-room door.
The most serious gap is unrestricted, unaudited access by the cleaning contractor to the server room. Twelve people can enter a room containing payment-card infrastructure, and the only detective record is a pass log reviewed after something goes wrong. That is not least privilege and not access review. It is worse than the broken camera because access is the primary control; CCTV is detective and cannot stop entry.
The tailgating incident and the unlocked meeting-room theft show the same pattern: controls exist on paper but are not enforced or monitored. The client's supplier agreement makes this a contractual issue, not only an internal housekeeping matter.
Layered fixes include separating the cleaning pass from the server-room door, escorting or scheduling cleaning, reviewing access logs regularly, repairing CCTV and defining retention, and testing whether staff challenge unbadged followers. The facilities manager's statement is therefore inaccurate: the building has a reception function, but the server room has no effective access control.
2. What should be required of the cleaning contractor before access continues?
Read the worked answer
Treat the cleaning contractor as a supplier with access, not as invisible staff.
The minimum before access continues:
- A written agreement covering confidentiality, acceptable behaviour, reporting duties, supervision and the consequences of breach. A.5.20 Supplier agreements and A.6.6 Confidentiality or non-disclosure agreements apply.
- Named personnel and screening. The company should know which 12 people require access and apply proportionate screening and induction. A.6.1 Screening and A.6.2 Terms and conditions of employment are relevant even though the staff are not direct employees.
- Least-privilege access. Cleaning staff do not all need server-room access. Issue a separate, time-limited credential for the named cleaners, restricted to the cleaning window and revoked when the contract or individual changes. A.5.15 Access control and A.5.18 Access rights apply.
- Escort or supervision in the secure area, especially while payment-card racks are present. A.7.6 Working in secure areas and A.7.2 Physical entry apply.
- Access review and logging. Review the pass log monthly, not only after an incident, and record the review. A.5.22 Monitoring and review of supplier services supports this.
- Clear reporting and incident clauses. The contractor must report lost passes, suspicious behaviour and incidents immediately. A.5.24 and A.6.8 apply.
- Return of assets and removal of access at termination. A.5.11 Return of assets should cover passes and keys.
The client will want evidence that the contractor is governed by an agreement, that access is limited to named individuals, and that reviews actually happen. A signed contract alone is not enough; the access list and review records are the proof.
3. Which Annex A controls in ISO/IEC 27001:2022 apply, and what evidence would you show the client?
Read the worked answer
Applicable Annex A controls
- A.7.1 Physical security perimeters - the server room needs a defined boundary.
- A.7.2 Physical entry - controlled entry, separate from the building pass.
- A.7.3 Securing offices, rooms and facilities - the unlocked meeting room and the server room both fall here.
- A.7.4 Physical security monitoring - CCTV coverage, retention and repair.
- A.7.6 Working in secure areas - supervision and rules for contractors inside the room.
- A.7.7 Clear desk and clear screen - relevant to the stolen laptop and unattended areas.
- A.5.15 Access control, A.5.18 Access rights - least privilege and review.
- A.5.19/A.5.20 Supplier relationships and agreements - the cleaning contractor.
- A.5.22 Monitoring and review of supplier services - evidence that the contractor is actually overseen.
- A.6.1/A.6.2 Screening and terms and conditions - contractor personnel.
- A.8.1 User endpoint devices - the stolen contractor laptop and device rules.
Evidence to show the client
An access-control matrix showing who may enter the server room and why; the cleaning contract and confidentiality terms; a current list of named cleaning staff with expiry dates; pass-log review records for the last three months; CCTV maintenance and retention records; the incident report for the theft and the tailgating observation with corrective actions; and a site walkthrough record confirming locks, cameras and signing-in rules.
The client is not asking for a policy library. It is asking whether payment-card infrastructure is protected in practice. The strongest evidence is a short access list, regular review signatures and a closed corrective action for the tailgating event.