The 2 A.M. Contractor at the Data Center
At 02:15 on a Sunday, a security officer is alone at the lobby desk of a data center. A man in a work jacket with a tool bag bangs on the glass. He has no company badge. He says he is a contractor from 'Cooling Solutions' and that his supervisor spoke to 'someone' about an emergency repair; the building's cooling unit is failing and he has 15 minutes before servers overheat. He shows a photo on his phone of a work order with the data center's address but no name or signature. He is breathing fast, talks over the officer, and says, 'If you don't let me in, you're going to cause a million-dollar outage.' The officer has a visitor log, a phone list, a badge printer, and a duress button. The contractor is not on the after-hours access list. The officer's supervisor is not answering. The man steps closer and puts his hand on the door handle.
1. Should the officer admit the contractor? What verification steps are appropriate?
Read the worked answer
The officer should not admit him on the current information. The urgency claim is a classic social-engineering pressure tactic, and a photo of a work order can be altered or copied. The officer's duty is to verify through an independent channel, not through the person at the door. He should call the data center's on-call facilities manager from the internal phone list, and call Cooling Solutions at its published main number, not a number the contractor provides. He should confirm the contractor's full name, the work order number, the scope, and the after-hours authorization. He should ask for a government-issued photo ID, log it, issue a temporary badge, and require an escort. Critical infrastructure normally uses two-person verification and an escort for non-badged workers. If the cooling failure is real, the facilities manager or the building monitoring system will confirm it. Until then, the door stays locked.
2. How should the officer de-escalate the situation while keeping the access-control boundary?
Read the worked answer
He should keep the glass door between them, step back slightly, lower his voice, and slow the pace. He can acknowledge the concern without accepting the demand: 'I understand you're worried about the servers. I can't open the door until I verify you with the facilities manager.' He should give a concrete next step: 'I'm calling the on-call manager now; please step back from the door and have your ID ready.' He should avoid arguing about the million-dollar figure or trying to match the man's urgency. He should watch the man's hands, breathing, and the tool bag, and keep his own exit clear. If the man tries to force the door, the officer should not grapple with him; he should retreat, press the duress button, call 911, and give a description. Opening the door to calm him down would reward escalation and defeat the access-control policy.
3. What should the officer document, and what should the client review afterward?
Read the worked answer
The report should record the time, the man's description, vehicle if any, the exact statements, the work-order photo, the name he gave, the calls made, the times of those calls, the supervisor notification, and the fact that he was not on the after-hours list. The officer should preserve lobby video and the visitor log, and note whether the man left on his own or police were called. If verification later shows he was legitimate, the report should record who approved entry, what ID was checked, and who escorted him. The client should review the after-hours contractor policy: a current call list, a requirement for a work-order number from the facilities manager, two-person verification, temporary badges, and escort rules. The officer should not label the man a thief or terrorist in the report; he should describe behavior and leave conclusions to investigators.