Physical security audit program for data centre and server rooms.
How to audit whether the data centre, server rooms and technical rooms are protected against unauthorised access, fire, water, overheating and power failure.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation divides its rooms for IT equipment into security zones, controls and monitors access effectively and protects equipment against environmental threats and loss of supply. It also assesses whether maintenance, inspections and emergency measures for building services are carried out demonstrably.
Scope
- Own data centres, server rooms and technical rooms, including distribution rooms at sites
- Access control, surveillance, fire protection, climate control, power supply and cabling
- Maintenance contracts and inspection records for building services
- Out of scope: provider data centres, which are considered separately through certificates or reports
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | Security zones are defined; rooms for IT equipment lie within a protected area with clear boundaries. | ISO/IEC 27001:2022 Annex A 7.1; BSI INF.2 | Review the zone plan and check boundaries, doors, windows and entrances during a walkthrough. | Zone plan, walkthrough record with photos |
| 2 | Only authorised persons gain access; access rights are requested, approved and reviewed regularly. | ISO/IEC 27001:2022 Annex A 7.2 | Reconcile the list of persons with access against staff and provider lists and review the last recertification. | Access rights extract, approvals, review record |
| 3 | Visitors and service providers are registered, escorted and their presence logged. | ISO/IEC 27001:2022 Annex A 7.2 | Reconcile the visitor book or electronic log of the last three months with maintenance visits. | Visitor log, maintenance records |
| 4 | Entrances and rooms are monitored; intrusion and door alarms are followed up. | ISO/IEC 27001:2022 Annex A 7.4 | Have the surveillance technology demonstrated and trace response and closure for three alarms. | Alarm logs, connection to control centre or security service |
| 5 | Fire detection and suppression are in place, suited to the equipment and inspected; water hazards are considered. | ISO/IEC 27001:2022 Annex A 7.5; BSI INF.2 | Review the fire protection concept and inspection reports and check water pipes, detectors and suppression during the walkthrough. | Fire protection concept, inspection reports of fire detection and suppression systems |
| 6 | Temperature and humidity are monitored; climate control is sized for the load and redundant. | ISO/IEC 27001:2022 Annex A 7.11; BSI INF.2 | Analyse readings for the last three months and check redundancy and alerting of the climate control. | Measurement logs, alerting concept, climate control sizing |
| 7 | Power supply is protected against failure; UPS and standby generator are tested under load regularly. | ISO/IEC 27001:2022 Annex A 7.11 | Review UPS and generator test records and compare bridging time with requirements. | Test records, capacity calculation, maintenance reports |
| 8 | Power and data cables are protected against damage and interception and are documented. | ISO/IEC 27001:2022 Annex A 7.12; BSI INF.12 | Inspect cable routes during the walkthrough and compare them with the documentation. | Cabling plan, walkthrough record |
| 9 | Equipment is maintained according to manufacturer requirements; maintenance work is traceable. | ISO/IEC 27001:2022 Annex A 7.13 | Reconcile the maintenance plan with maintenance records of the last twelve months for climate, UPS and fire protection. | Maintenance plan, maintenance reports, maintenance contracts |
| 10 | Decentralised technical rooms and distribution cabinets at sites are locked and protected against environmental threats. | BSI INF.5 | Select two sites and check locking, access and surroundings of the technical rooms. | Site list, walkthrough records |
| 11 | Equipment is handled before disposal or re-use so that no data falls into the wrong hands. | ISO/IEC 27001:2022 Annex A 7.14 | Trace the process for retired equipment from the data centre and request destruction evidence. | Disposal records, destruction evidence |
| 12 | There is sufficient redundancy for the loss of a site, and site risks are assessed. | ISO/IEC 27001:2022 Annex A 8.14 | Review the site risk assessment and redundancy concept and assess distance and independence of the sites. | Site risk analysis, redundancy concept |
Documents to request
- Zone plan and floor plans of rooms for IT equipment
- Access rights extract and last review
- Visitor logs
- Fire protection concept and inspection reports
- Temperature and humidity logs
- UPS and standby generator test records
- Maintenance plan and maintenance reports
- Site risk analysis and redundancy concept
Typical findings
- Access rights of former employees and providers are still active.
- Service providers work unescorted and unlogged in the server room.
- The standby generator has never been tested under load.
- Combustible materials are stored in the server room, water pipes run above the racks.
- Climate alarms go to an unattended mailbox.
- Technical rooms at sites are unlocked or used as storage.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing