Data Centre Security: Controls Malaysian Businesses Should Check

Data centre security is the set of physical, operational and logical controls that protect the servers, network equipment and data housed in a data centre, from the site perimeter to the individual rack. For a Malaysian business placing systems in a colocation facility, those controls decide who can reach your equipment, how every entry is recorded, and what evidence you can show an auditor or regulator.

Data centre security claims are easy to state on a website and harder to evidence. The difference shows in the detail of each control layer and in the evidence a provider can produce, and both can be checked before you sign.

Why Data Centres Are So Heavily Guarded

Data centres are heavily guarded because a single facility can hold critical systems and data for many organisations at once, so one breach of physical access can affect all of them. A person who reaches a server can bypass many network defences, which is why physical security is treated as part of information security rather than as building management.

Data centre security therefore works in layers. Each layer, from the outer fence to the rack door, adds a separate check, so that defeating one control does not give access to the equipment.

The Four Physical Layers of Data Centre Security

Data centre security can be organised into four physical layers, each with its own controls and its own evidence.

1. Site perimeter

The site perimeter is the first barrier: fencing, controlled vehicle entry, guarded gates and camera coverage of approaches and parking areas. Check how vehicles and deliveries are screened before they reach the building, and whether perimeter cameras are monitored live or only recorded.

2. Building entry and visitor management

Building entry is where identity is verified. A well-run facility pre-registers visitors, checks identity documents against the booking, issues time-limited passes, and escorts visitors who are not authorised for unescorted access. Every entry and exit should appear in a visitor log that the provider can produce for your own staff and contractors.

3. Data hall access

The data hall should require stronger authentication than the building, for example an access card combined with a biometric or PIN. Mantraps or interlocking doors prevent tailgating, where a second person follows an authorised one through a door. Access rights should be granted per person and reviewed regularly, so former staff and one-off contractors lose access promptly.

4. Rack and cage

The final layer is the equipment itself. Locked cabinets, private cages or private suites separate one customer’s equipment from another’s, and key or code control records who opened each cabinet. Ask how keys are issued and logged, and whether cabinet doors can be monitored or alarmed.

Manned Security and Monitoring

Manned security and continuous monitoring turn the physical layers into a working system. Guards respond to alarms, enforce escort rules and check passes, while a monitoring team watches cameras and access-control alerts for forced doors, repeated failed entries or doors held open.

Ask three questions about monitoring. How long is camera footage retained, and can it be retrieved for a specific date and time if you need it for an investigation? How are access-control alarms escalated, and to whom? Can the provider produce access reports showing every entry to your cage or rack?

CGSO Protected Areas and Protected Places in Malaysia

In Malaysia, some data centres are declared protected premises under the Protected Areas and Protected Places Act 1959 (Act 298), with security overseen by the Chief Government Security Office (CGSO) in the Prime Minister’s Department. A protected place is any premises declared as such under the Act, and entry is restricted to persons with permission, with authorised officers empowered to remove anyone present without it.

A CGSO declaration sets an external security standard for a facility rather than one the operator defines for itself. When a provider states that a facility is CGSO-declared, ask which specific site the declaration covers, because a declaration applies to named premises, not to every facility an operator runs.

Certifications and Assessments That Evidence Data Centre Security

Certifications and assessments are how a provider shows that its security controls are designed and operated consistently, rather than only described.

1. ISO/IEC 27001: The international standard for an information security management system, covering people, policies and technology. Ask for the certificate and check two things: the scope, which should name the facility you are using, and the edition. The transition from the 2013 edition ended on 31 October 2025, after which ISO/IEC 27001:2013 certificates expired or were withdrawn, so a current certificate should be issued against ISO/IEC 27001:2022.
2. Threat, vulnerability and risk assessment (TVRA): An assessment of the threats a site faces and the weaknesses in its physical security, with recommended measures. Ask when the latest TVRA was carried out and how its findings were addressed.
3. Data centre resilience and risk assessment (DCRA): For Malaysian financial institutions, Bank Negara Malaysia’s Risk Management in Technology policy document requires an external DCRA at least once every three years, and it expects the production data centre to be physically secured from unauthorised access.
4. PCI DSS: The payment card industry data security standard, relevant if card data passes through systems in the facility. Ask which services the provider’s compliance covers, since your own systems need their own assessment.

Logical Security in a Colocation Data Centre

Logical security in a colocation data centre is shared between the provider and the customer. The provider is responsible for the facility, its access-control and monitoring systems, and the shared network infrastructure, such as cross-connects and meet-me rooms. The customer remains responsible for the servers, operating systems, applications and data it installs.

Clarify that division in writing before you move in. Ask how the provider segregates its own management networks from customer networks, who can patch or move cross-connects, and how those changes are approved and logged.

How to Verify Data Centre Security on a Site Visit

A site visit is a direct way to verify data centre security, because you experience the controls as a visitor would. Use the visit to test the process rather than only to tour the building.

1. Book the visit formally: Note whether the provider asks for your identity details in advance and checks them on arrival.
2. Watch the entry sequence: Count the separate checks between the gate and the data hall, and note whether doors prevent two people passing on one authorisation.
3. Ask for a log extract: Request an example access report, such as the entries recorded for a test cage or for your own visit.
4. Check escort rules: Note whether you are escorted throughout, and whether the escort can open areas you are not booked to see.
5. Read the certificates on site: Compare the scope and edition on each certificate with the facility you are standing in.
6. Ask about incidents: Ask how a security incident would be reported to you and how quickly.

Data Centre Security Checklist

Where We Fit

At Strateq, we have operated data centres in Malaysia since 1989 and are one of Malaysia’s pioneer data centre providers. Our Petaling Jaya data centre is a CGSO-declared Protected Area and Protected Place: access is restricted to authorised persons, the site is subject to CGSO security audits, the premises are manned by Auxiliary Police with police patrol visits and record-keeping, and a hotline connects the site to the police station. Unauthorised photography and filming are not permitted.

Our Malaysian facilities hold ISO/IEC 27001:2022 and have undergone threat, vulnerability and risk assessments (TVRA) and data centre resilience and risk assessments (DCRA). Our colocation and data centre management services run in purpose-built facilities that we own and manage.

For the wider decision beyond security, use our enterprise data centre checklist to compare providers across all seven decision areas.