Security Architecture and Engineering · Topic 7 of 8
Site and Facility Security
Site and facility design with CPTED, data center and wiring closet controls, media storage, evidence storage, power, HVAC, fire suppression and environmental issues.
- 3 min
- Life safety first; egress cannot be blocked.
- CPTED: natural surveillance, natural access control, territorial reinforcement.
- Know power problems and their fixes.
What it is
Physical security protects people, equipment and data from physical threats: intruders, fire, flood, power loss and environmental damage. Good facility design builds security in from site selection onward. Life safety always comes first.
How it works
Site and facility design principles
- Site selection: consider crime, natural hazards (flood, earthquake), access for emergency services and proximity to utilities.
- Crime Prevention Through Environmental Design (CPTED): natural surveillance (clear sight lines, lighting), natural access control (paths and entrances that guide people), territorial reinforcement (signs and design that show ownership).
- Layered defense: deter, delay, detect, assess and respond, from the perimeter inward.
- Avoid single points of failure in utilities and communications.
Controls by area
| Area | Controls |
|---|---|
| Perimeter | Fences, bollards, lighting, cameras, intrusion sensors, guards |
| Entrances | Badge readers, mantraps or access control vestibules, turnstiles, visitor management |
| Wiring closets and intermediate distribution facilities | Locked, access-logged, not shared with janitorial storage |
| Server rooms and data centers | Multifactor entry, no windows, raised floors or overhead cabling, monitoring |
| Media storage | Locked, environmentally controlled, inventoried |
| Evidence storage | Restricted access, logging for chain of custody |
| Restricted and work areas | Badge zones, clean desk, escort rules |
Badges alone can be lost or shared. Adding a PIN or biometric at sensitive doors gives two factors without staffing them.
Power
| Problem | Meaning | Mitigation |
|---|---|---|
| Blackout | Complete loss of power | Generator, UPS |
| Brownout | Prolonged low voltage | UPS, line conditioner |
| Sag | Momentary low voltage | UPS |
| Spike / surge | Momentary or prolonged high voltage | Surge protection |
| Noise | Electromagnetic or radio frequency interference | Line conditioning, shielding |
A UPS bridges short outages and gives time for generators to start or systems to shut down cleanly.
HVAC and environment
Control temperature and humidity. Very low humidity causes static discharge that damages components; very high humidity causes condensation and corrosion. A controlled mid-range (commonly cited as about 40 to 60 percent relative humidity) is the traditional guidance. Use positive air pressure so contaminants and smoke are pushed out, and monitor for water leaks.
Fire prevention, detection and suppression
| US fire class | Fuel | Suppression |
|---|---|---|
| A | Ordinary combustibles (paper, wood) | Water, foam |
| B | Flammable liquids and gases | CO2, foam, dry chemical |
| C | Electrical equipment | Non-conductive agents such as CO2 or clean agents |
| D | Combustible metals | Dry powder |
| K | Cooking oils and fats | Wet chemical |
| Sprinkler type | Behaviour |
|---|---|
| Wet pipe | Water always in pipes; fast, risk of leaks |
| Dry pipe | Air in pipes until triggered; for cold areas |
| Deluge | All heads open at once; for high-hazard areas |
| Pre-action | Pipes fill on a first trigger, heads open only on heat; preferred for data centers |
Clean agent gas systems (for example FM-200 or inert gases) suppress fire without water damage. Halon is no longer produced because it damages the ozone layer. Detection uses smoke, heat and flame sensors.
Life safety
Emergency exits must stay usable: code-compliant egress hardware cannot be removed for security. Use exit alarms, cameras and response procedures instead. Doors that must protect people fail safe (unlock) on power loss; doors protecting assets may fail secure where codes allow.
How the exam asks about this
- "Remove push bars so staff cannot leave with equipment." No; keep egress, add alarms and cameras.
- "Static damage to memory modules at 15% humidity." Humidify to a controlled mid range.
- "Which sprinkler system reduces the risk of accidental water discharge in a data center?" Pre-action.
What to remember for the exam
- Life safety first; egress cannot be blocked.
- CPTED: natural surveillance, natural access control, territorial reinforcement.
- Know power problems and their fixes.
- Fire classes A, B, C, D and K; pre-action sprinklers for data centers.
- Control humidity to avoid both static and condensation.
Fail-secure doors on escape routes endanger lives. Personnel safety outranks asset protection.
Common mistakes
Choosing water for electrical fires.
Using wet pipe sprinklers over servers when pre-action is available.
Treating physical security as separate from information security.
Check yourself
What is a brownout?
A prolonged period of low voltage.
Which sprinkler type needs two triggers before releasing water?
Pre-action.
Which fire class covers electrical equipment in the US scheme?
Class C.
Topic 7 of 8 in Security Architecture and Engineering
Test yourself on Security Architecture and Engineering
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.