Data Centre Security Course: Lessons 2026

Lesson 1: Layers and security zones

A data centre holds servers that store and process information. Losing a server, or letting the wrong person touch it, can expose the data of thousands of people. Good protection uses layers: a person must pass several checks to reach the most sensitive area.

Government of Canada guidance from the RCMP calls these layers security zones. Zones are set up in a progressively restrictive way, from the public zone inward. The guidance says zones should not be skipped, bypassed or left out. A visitor passes each boundary in order.

Where a server room goes

The RCMP guide sets the minimum zone for a server room by the most sensitive information on its network. A threat and risk assessment may place it higher.

Private data centres are not bound by this federal guide, but the same layered idea works anywhere. Your post orders will say which areas are restricted and who may enter.

Remember that provinces such as Alberta and British Columbia require security guards to hold a provincial security licence. This course is background knowledge only and does not replace that training.

Lesson 2: Badges, visitors and escorts

Access to a server room should be limited to screened people who have an operational need to be there, plus properly escorted visitors. The RCMP guide warns that when more people are given access, the chance of a compromise goes up.

Access cards

• Challenge anyone in a restricted area who is not wearing or showing an approved card.
• A person who loses a card must tell their supervisor and the security office right away, so the card can be marked lost in the system.
• Anyone who finds a card should return it to the security desk.
• Access should be removed when a person no longer needs it.

Visitors

Security staff check each visitor's identity. The RCMP access guide says visitors should leave a valid government-issued photo ID before they receive an access card. Visitor cards are handed out and collected every day.

An escort must keep the visitor in sight at all times and stay alert. If the visitor is handed to a meeting host, the host becomes responsible for the escort.

Tailgating and piggybacking

These happen when an unauthorized person slips through a door behind someone who badged in. Turnstiles let only one person through at a time. An airlock (a small room between two doors) lets several people in together, which raises the risk of piggybacking.

Doors, keys and codes

• Doors that are normally locked must not be propped open.
• Combinations must not be written down where others can find them.
• If a key is lost, lent or stolen, the lock must be replaced.

Lesson 3: What a server room needs

The RCMP guide lists basic safeguards for a server room. Knowing them helps you spot a weakness on patrol.

• Servers sit in a separate room with access control, such as a mechanical lock or a card reader.
• Walls run from the floor slab to the slab above. Walls that stop at a suspended ceiling do not meet the requirement, because a person could climb over.
• Keys and access cards for the room are managed and stored securely.

Servers in a shared room

A server in a shared room can be treated as locked up if it has a secure lid lock, drive locks, port lock-out devices (for USB, network and other ports) and is anchored to the rack. Another option is a lockable cage.

Higher levels

• A secure server room should be monitored all the time by an electronic intrusion detection system.
• In a secure data centre, staff in a control room watch the servers all the time through a glass window or wall. Areas they cannot see directly should be covered by CCTV.
• The control room must be staffed whenever server access is allowed, and around the clock for a site that runs 24/7.

Lesson 4: Equipment and storage media

Hard drives, USB keys and other storage media can hold data long after files are "deleted". The Canadian Centre for Cyber Security warns that sensitive data may still be recoverable after a user deletes it.

Sanitization is a process that makes the data impossible to recover while the media can still be reused. The Cyber Centre does not recommend physical destruction on its own as a sanitization method. Government departments must keep detailed disposition records for surplus media.

Chain of custody

A chain of custody is a record, in time order, of who had the media and what was done to it, from the time it is picked for sanitization until it is disposed of.

Your role

• Check that any equipment leaving the site has written approval, as your post orders require.
• Record what leaves, who takes it and when.
• Never take discarded drives or equipment for yourself, even if they look like junk.
• RCMP guidance says that when protected or classified material is destroyed, authorized people must watch, and anyone who shreds it or watches must be screened to the highest level of what is being destroyed.

Lesson 5: Safety hazards and reporting incidents

Data centres use backup power systems, often with large banks of batteries. The Canadian Centre for Occupational Health and Safety (CCOHS) explains the hazards of charging lead-acid batteries:

• Charging can give off hydrogen gas, which can explode in some amounts in air.
• Batteries should not be charged or handled near heat, flames or sparks.
• The room needs good ventilation to bring in fresh air.
• The battery acid (sulfuric acid) is corrosive, so eyewash stations and emergency showers are needed.

Handling incidents

RCMP guidance says security incidents must be dealt with right away and then reported to the right security officials. Follow your post orders for who to call: usually your supervisor and the site's security or IT team.

For cyber incidents, organizations in Canada can use the Canadian Centre for Cyber Security's online form to find out where to report. In an emergency, the Cyber Centre says to contact local police. Call 911 for fire, injury or a crime in progress.