Data Centre Contractor Access: Keep Repairs Moving, Keep Control

A generator technician is booked for 7 a.m., a cabling crew wants to start early, and a customer’s engineer has a ticket for tonight. Each visit needs the same four answers from the operator: who approved this person, for which rooms, until when, and who switches the access off afterwards. When those answers sit in one record with a named owner, contractor work can move quickly and still leave a clear trail. When they are spread across email, the badge system and someone’s memory, a repair can stall at the door, or a temporary badge can stay live long after the job is done.

Most of the fix is process. Tie a named person to a job, a zone and a time window. Give access no wider than the task. Brief the escort. Set a clear hold point for when the work changes. Close the visit deliberately. Equipment helps where it enforces those decisions, and only there.

People who work around data centres describe this in public forums as everyday coordination: someone on the operations or support team arranges the visit, and escort practice varies from site to site. Those are individual accounts and say nothing about how often access goes wrong. They do show where the friction sits: in the hand-offs between the customer, the operator, security and the contractor.

What should a contractor access request contain?

Enough to connect a named person to an approved job, a defined place and a time window, and no more personal information than that purpose needs. A workable request records:

• the sponsoring customer, team or department, and the person who authorised the work;
• the contractor’s name and employer, checked through the site’s approved process;
• the work order or service ticket and a one-line purpose;
• the zones or customer spaces required, and whether an escort is needed;
• the planned start and finish, plus who can extend the window;
• equipment or materials expected to come in or leave; and
• a contact who can resolve a mismatch at the door.

Keep “this person is expected” separate from “this person is approved for this area”. A long vendor relationship does not authorise every employee, subcontractor or type of work. A ticket opened by a customer does not, by itself, grant entry to shared plant, a meet-me room or another tenant’s cage. In a colocation contract, find out who can approve access to each boundary. One U.S. provider’s posted data centre rules give an example: only people with roster management rights can grant access to a customer’s space, and written work descriptions and methods of procedure must be reviewed before work is approved or starts. That is one company’s terms, but it shows the kind of boundary worth writing down.

Collect only what the check needs. The Office of the Privacy Commissioner of Canada’s identification and authentication guidelines advise organisations to collect the minimum information required, to avoid using numbers such as driver’s licence numbers as identifiers where possible, and to decide how long the information is kept and how it is destroyed. Looking at a photo ID to confirm a name is a different act from copying the licence number into a spreadsheet.

How narrow should the access be?

As narrow as the job, whatever the contractor’s company relationship. The RCMP’s Access Management Guide (GCPSG-006, 2024) puts it plainly for federal facilities: people are not entitled to access merely because it is convenient. Private operators are not bound by that guide, but the principle travels well.

In practice, a technician servicing a mechanical room may need a route through shared corridors and nothing else. A crew inspecting the loading area does not need the data hall. A customer engineer needs their own cage, not the neighbour’s row.

Match the control to the risk and keep it light. Depending on the job, that might be a credential that expires at the end of the shift, a temporary badge returned at the desk, a key signed out and back in, a check-in with security, an escort, or a mix. Do not add biometrics or extra checks by default; weigh privacy, accessibility, staffing and what happens when the system is down first. If your system cannot set an end time on a credential or limit it to specific doors, that is a specific gap worth fixing in your access control system. If visitor booking and badge printing live in separate tools, our guide to integrating visitor management with access control covers how to join them.

Vendor logins to the security system itself are a separate question, covered in our guide to controlling vendor remote access.

What does an escort actually take on?

Responsibility. The escort knows the approved task and its boundaries, watches for activity outside them and can reach help. If the policy requires escorts, the duty has to be written down and staffed.

The RCMP guide lists escort practices that suit any critical facility, again written for government sites:

• brief the visitor or contractor on restrictions before entry;
• assign an escort with enough knowledge of the area to recognise unauthorised activity, for example in a server room;
• keep a register of who is on site, which also helps account for people during an evacuation;
• do not expect one escort to cover a large group, or contractors working in different areas; and
• when an escort hands a visitor over to a host, the host becomes responsible for the rest of the visit.

Escorts also cost money, and contracts differ. The same U.S. provider’s rules distinguish “stay” escorts, where staff remain with the contractor, from “drop” escorts, where the contractor is taken to the customer’s space and left there, and both carry a remote hands fee. If you buy colocation space, ask which kind of escort applies to each area, what it costs and how much notice it needs. If you run the site, define how a dropped-off contractor is monitored and how they summon help.

Who decides when the job changes on site?

One named role owns the live visit, with a named backup. The person at the door then has three options: admit within the approved scope, pause and call the approver, or refuse entry until the mismatch is resolved.

Changes are where a sound process tends to go informal. A different technician turns up under the same work order. The crew arrives two hours early. The job turns out to need a room that was not on the ticket. A familiar company name or urgent wording should not be enough on its own. When identity is in doubt, the RCMP guide suggests calling the person’s employer to confirm they work there and were sent to the site, which is a simple step any desk can take.

Record every exception: who approved it, what changed, when it takes effect and when it expires. Tell whoever is responsible for the affected zone. If the work expands into another tenant’s space or a higher-consequence plant room, get the approval that boundary requires.

There is an operational reason to keep the access approval tied to the work approval. Uptime Institute’s 2026 outage analysis announcement (May 13, 2026) reports that failure to follow established procedures remains the leading driver of human error-related outages. That global finding is about operations broadly and does not measure access control. It does support a simple rule: if the scope of the work changes, the approval should change with it.

How do you close the visit and the badge?

As deliberately as you opened it, with a named owner and evidence that it happened. Confirm departure, collect temporary badges and keys, disable temporary permissions, record any equipment movement your procedure requires, and close open work notes.

The University of British Columbia’s data centre physical security standard (M9), last revised in January 2021, is a useful Canadian example. It requires someone to be given the authority to grant data centre access and someone to be appointed to manage the access process formally, including revocation of cards, fobs and keypad access. It also requires access to be logged. That is one university’s policy, but the structure applies to any operator: approval and removal both have owners.

Long-term contractor badges need their own review. The RCMP guide says access privileges should be actively reviewed and removed when no longer required. An inactivity rule helps as a backstop (the U.S. provider above disables badges after 180 days without use), but it will not catch a badge that is still being used by someone whose contract has ended.

Keep the records useful. The Canadian Centre for Cyber Security’s physical and environmental protection controls treat physical access authorisations, monitoring of physical access and visitor access records as separate controls, and call for visitor records to be kept for a set period, reviewed at a set frequency and anomalies reported. It is government risk-management guidance with organisation-defined settings, so choose a period and review rhythm that suit your site.

Plan for the access system being unavailable. A pre-approved fallback should still verify the person, the scope and the approver, and every manual entry should be reconciled once service returns. Never build a fallback that locks an exit or interferes with fire alarm functions; coordinate door changes with qualified fire and building code professionals.

How can you test the process without buying anything?

Run a short tabletop exercise with the people who actually handle access: operations, facilities, security and customer service. Walk through one routine visit and one after-hours exception. Do not test by attempting unauthorised entry or by interfering with a live data hall.

Scenario	What good looks like
Named contractor arrives for approved work	Staff find the sponsor, job, permitted areas and time window in one place
A different worker arrives on the same work order	Staff know how to check identity and who approves the substitute
The work expands into another area	There is a clear hold point and the right approver answers
Urgent repair after hours	Backup approver and escort coverage both work
Visit ends or is cancelled	Temporary access is closed and badges are back or disabled
Access system is down	Staff follow the fallback and reconcile the record later

If you are a colocation customer, ask your provider to walk through the same scenarios and to show a redacted sample visit record. Do not ask for floor plans, camera positions or credential formats; a good process can be shown without them.

Then decide in proportion. If the exercise shows clear ownership and your existing system already records what you need, you may not need anything new. If the gap is ownership, fix the procedure first. If the system cannot enforce the agreed time, area or approval boundary, that is when a technical change earns its cost.

Where should you start this week?

Pick one real maintenance visit from last month and trace it from request to badge closure. Write down every hand-off and who owned it. Any step without an owner is your first fix, and it costs nothing but a conversation.

If the trace turns up gaps in how doors, credentials and records work together, Securitron designs and services access control for data centres across the GTA and Ontario and can walk the site with your team.