Most physical security reviews start at the front door and stop at the cage door. That is a mistake. Cabinets and cages are the last barrier between a curious visitor and the equipment carrying production traffic, and they are the layer most likely to be forgotten once a room passes its commissioning inspection. A camera view of the aisle looks reassuring on a monitor. It tells you nothing about whether the cabinet next to the network core has a latch that stopped engaging last spring.
What follows is a working checklist, written for the person who has to walk the floor with a flashlight and a tablet. None of it needs new capital. Most of it needs an hour a month and the discipline to write down what you find.
Locks, Latches, and Keying
Start at the handle. Close each door from the outside and listen for the latch. A door that needs a shoulder to seat is a door with an unengaged lock, and cable pressure inside the rack makes that worse over time.
- Latch engagement. Confirm the door closes flush and the lock actually throws. Check the frame for bending or a warped panel.
- Hinge hardware. Non-removable pins on external hinges. Lift the door slightly with it open to test whether it can be walked off its hinges.
- Cam locks and swing handles. Keys should turn without grit and be removable only in the locked position. Worn cam locks are cheap to replace and easy to overlook.
- Electronic locks. Export the audit trail and confirm it is readable. Check battery or power status, and know the fail state: fail secure or fail safe. Whichever it is, make sure someone has decided that it matches the risk.
- Key control. Restricted keyways, a master-key hierarchy documented somewhere other than a technician's memory, and a sign-out log that is actually used.
- Cage structure. Test every panel, not just the gate. Look at corner posts, panel-to-post fasteners, and mesh gauge. Check whether the cage shares a wall with a tenant you do not control.
- The space above. A cage that stops at eight feet with an open drop ceiling above it is a climbing invitation. Confirm the cage is capped, or that the ceiling is a rated barrier, or that detection covers the gap.
Sensors and Monitoring Paths
A door contact is only as good as the route its alarm takes. Test it by opening the door and watching the monitoring console, not by trusting the last commissioning report.
- Door contacts on every cabinet door and cage gate, tested on a schedule, with the resulting alarm visible to someone on shift.
- Panel tamper switches on side and top panels. Many panels come off from the outside in under a minute.
- Vibration or shock detection on high-value cages, tuned so a bump from a cart does not trigger a nightly nuisance alarm.
- Environmental telemetry: intake and top-of-rack temperature, humidity, and water detection near cooling units and under the floor. Heat is a failure mode as much as intrusion is.
Label every sensor with its asset ID and the panel and zone it reports to. A technician matching a door to a point on a console at 2 a.m. should not need twenty minutes and a phone call.
Camera Coverage at Cabinet Scale
Coverage designed for aisles rarely resolves cabinet-level events. You need to see hands and locks, not just the top of a rack. Pair an aisle overview showing who approached with a closer view of the cabinet face.
Gaps that show up again and again
- A new rack, a pallet of boxes, or a ladder blocking a camera that was positioned two years ago.
- Bright aisle lighting with a dark cabinet interior, turning every event into a silhouette.
- Blind spots behind full-height racks and above cage tops.
- Doors that open into an adjacent aisle where the nearest camera is pointed the other way.
- Retention shorter than your investigation cycle. If a problem is typically discovered three weeks late, fourteen days of retention is not coverage.
Export a still frame from each camera at audit time and compare it with the previous one. Drift is easy to spot side by side and nearly impossible to spot in a live view.
Tamper Evidence
Detection is reactive. Tamper evidence buys you time and gives an investigator a starting point. Use serialized seals on cabinets that are not opened weekly, and record the numbers in the maintenance log rather than on a sticky note inside the door. Security screws on side and top panels help; a paint line drawn across each screw head and onto the panel helps more, because it shows movement rather than resisting it. Numbered cable ties on cage panel joints are cheap and immediately readable.
Photograph the front, sides, and cable dressing of each cabinet when the audit is clean. That baseline turns a vague feeling that something looks different into a dated comparison. Pay attention to patch cables crossing between cages — a jumper looping through a neighbor's cabinet is a common way to reach equipment you are not authorized to touch.
Visitor Logging at the Cabinet Level
Badge logs prove entry to the room. They do not prove who opened a specific cabinet. Close that gap deliberately.
- Require a work order or ticket reference before any cabinet is opened, and record the cabinet ID against it.
- Check photo ID for vendors and contractors, and confirm the escort is named on the ticket.
- For mechanical locks, keep a cabinet-level log at the cage door and reconcile it weekly against the room access system.
- Review access logs against work orders once a week. Any door opened without a corresponding ticket deserves a conversation, not a shrug.
Camera footage and access logs together tell a story. Either one alone usually leaves an unanswered question.
Making the Audit Repeatable
Walk the same route in the same order every time, so a skipped cabinet is obvious. Score each item pass, fail, or needs work, and put a name and a date against every remediation. Fix the small things on the spot: tighten the latch, replace the seal, relabel the sensor. Monthly visual checks, quarterly functional tests of locks and alarms, and an annual full review of coverage and retention will catch nearly everything that matters.
Regulatory and contractual requirements for access records vary by jurisdiction, industry, and client, so confirm your retention and logging obligations with whoever owns compliance before changing the routine. Then keep the output short. A one-page report with photos and open items gets acted on; a forty-page binder does not.
Photo: jarmoluk / Pixabay
