Converting an Office Suite into a Card Data Room
A personalization bureau is converting a 1970s office suite into a Card Data Room for storing 60,000 blank contactless cards before personalization. The room has steel-stud drywall partitions that stop at a suspended acoustic ceiling; the plenum above the ceiling is continuous with the neighboring tenant's suite. The only door has a badge reader with PIN, a door contact, and a request-to-exit sensor. A single fixed camera covers the corridor door but not the room interior. Company policy permits visitors only when escorted. Ten days before go-live, facilities proposes to install a network switch above the ceiling and pull cable through a 2-inch conduit that penetrates the drywall. There is no budget for slab-to-slab masonry, but the project sponsor suggests 'compensating controls' such as extra patrols and a signed visitor log.
1. What physical-security weaknesses exist in the proposed Card Data Room, and which can be mitigated with the sponsor's suggested controls? What should the assessor conclude about go-live?
Read the worked answer
The boundary is the core problem. Drywall stopping at a suspended ceiling, with an open plenum shared with another tenant, means a person can enter above the locked door without presenting a badge. Extra patrols and a visitor log do not compensate: they do not detect or prevent access through the ceiling, and the requirement is for a controlled boundary, not an observation schedule. The interior camera gap is also significant because storage is the sensitive activity; door-only coverage cannot show who handled card stock. The door hardware itself (badge plus PIN, door contact, request-to-exit) is reasonable, but it protects only the door. A conduit penetration must be sleeved, sealed, and inspected so it does not create a bypass. My conclusion: do not store the 60,000 cards in this room as designed. Either extend the walls to the structural slab and secure the plenum, or place the stock in an approved secure container or vault inside the room and treat the room as non-secure. 'Compensating controls' cannot make an open ceiling equivalent to a secure boundary.
2. The switch installation must proceed before go-live. What contractor, penetration, and post-work controls should be required?
Read the worked answer
Treat the contractor as an untrusted visitor with privileged tools. Require identity verification, a signed work order, an escort with authority to stop work at all times while the contractor is inside the boundary (and above the ceiling), and a tool and material inventory before and after. The contractor should not have unescorted access to the room, the plenum, or any card stock. The 2-inch penetration should be sleeved and firestopped, with the sleeve bonded to the wall so it cannot be pushed aside; the plenum side must be inspected before closure. After the work, security should inspect the plenum and wall for new openings, remove all debris and temporary cabling, verify the switch is hardened and its management port is on a restricted VLAN, and log the change. If the contractor must work above the ceiling, use two-person control and continuous observation, because the ceiling is the weakest point. The work should be completed before any card stock is moved in, not concurrently with storage.
3. Management argues that because the cards are blank and unpersonalized, the open ceiling and camera gap are acceptable for a 10-day bridge. Evaluate that argument.
Read the worked answer
Blank contactless cards are not cardholder data, but they are still negotiable production stock: theft enables counterfeit or unauthorized personalization, and inventory loss can disrupt an issuer's run. The risk is lower than for personalized cards, but the physical requirement is about protecting card production materials, not only PANs. A 10-day bridge with 60,000 cards in an open-plenum room creates an opportunity for unnoticed removal, especially since the camera does not cover storage. If management accepts the risk, I would require the stock to be held in a locked, anchored safe or cage with dual custody and a daily count, a temporary motion sensor above the ceiling, and a written, time-bound risk acceptance signed by the security owner-not merely a verbal decision. I would still not call the room compliant; I would call it an exception with compensating storage controls and a hard move-out date.