Critical Equipment Rooms, Server Rooms and Technology Rooms under the ABS Guidelines

Server rooms, telecommunications rooms, electrical rooms and other infrastructure spaces may receive relatively little attention compared with public entrances or customer-facing areas, yet disruption to these rooms can have a major effect on a financial institution’s operations.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) specifically addresses Critical Equipment Rooms and also refers elsewhere to technology rooms, data halls and telecommunications rooms.

ABS defines a Critical Asset as a facility, system or equipment which, if damaged or destroyed, could have a debilitating impact on the infrastructure or the financial institution’s operations. Examples include air-handling units, electrical systems and telecommunications rooms.

This means the security question should not simply be:

“Is this called a server room?”

The more important question is:

“Would damage, destruction or unauthorised access to this room or its equipment materially disrupt the financial institution?”

If the answer is yes, stronger physical security may be justified.

What is a Critical Equipment Room under the ABS Guidelines?

ABS defines critical equipment as assets essential to supporting facility operations.

It specifically refers to equipment supporting:

electrical power, water supply, air supply, communications systems and networks, and fire-protection systems.

The guideline highlights why these systems matter.

Damage to supporting infrastructure can cause consequences greater than the direct effect of the original incident. ABS gives the example of fire-protection-system failure following an explosion, where the resulting harm could exceed the direct impact of the explosion itself.

Criticality therefore depends on consequence, not simply the value of the equipment.

Is a server room considered a Critical Equipment Room?

The ABS Critical Equipment Room section does not specifically use the term “server room”.

However, it includes equipment supporting:

• communications systems; and
• networks

within its definition of critical equipment.

Elsewhere, the guideline separately identifies technology rooms and data halls as typical CCTV surveillance locations.

Consultant’s perspective

A server room may therefore reasonably fall within the wider critical-equipment concept where the systems inside it are important enough to the FI’s operations.

But this should be established through the Physical Security Risk Assessment, rather than assuming every room labelled “Server Room” automatically has the same risk classification.

What makes a room “critical”?

ABS’s Critical Asset definition provides the key test.

An asset may be considered critical where its damage or destruction would have a debilitating impact on the infrastructure or FI operations.

A practical assessment could therefore ask:

What happens if this room becomes unavailable?

For example, would the loss result in:

• loss of communications;
• loss of network connectivity;
• major business downtime;
• failure of essential building systems;
• loss of fire-protection capability; or
• disruption of critical operations?

Those examples are practical applications of the ABS criticality concept rather than a separate ABS classification.

Are telecommunications rooms Critical Assets?

ABS specifically lists telecommunications rooms as an example of a Critical Asset.

That does not necessarily mean every telecommunications room has identical criticality.

The risk assessment should consider what equipment the room supports and the consequences of losing it.

For example, a telecommunications room serving an entire office or critical operation may deserve stronger protection than a room supporting a small non-critical area.

What about electrical rooms?

ABS also specifically identifies electrical systems among its examples of Critical Assets.

A financial institution in a tenanted building may not directly control:

• main switch rooms;
• electrical risers;
• generator rooms;
• UPS systems; or
• other base-building infrastructure.

However, if the FI relies on those systems for continued operations, they can still form part of the FI’s security dependency.

What about air-conditioning and ventilation equipment?

ABS identifies equipment supporting air supply and gives air-handling units as an example of a Critical Asset.

The importance of such systems can vary considerably.

For example, loss of air-conditioning in a normal office area may cause inconvenience, while loss of environmental control to technology infrastructure could potentially have more serious operational consequences.

The FI should therefore assess criticality based on impact.

What about fire-protection equipment rooms?

ABS specifically includes equipment supporting fire-protection systems in its definition of critical equipment.

This is particularly important because some equipment may support emergency response itself.

The security of such infrastructure should therefore be considered not only from an asset-protection perspective but also in terms of maintaining the building’s ability to respond to another incident.

Where should critical equipment be located?

ABS says critical equipment should, where practicable, be:

located away from higher-risk areas, concealed and protected.

The wording “where practicable” is important.

This is a design consideration rather than an absolute statement that every existing critical room must be relocated.

For a new office or facility, however, room location can be considered early in the design.

Should a server room be placed near a public area?

The ABS guideline does not specifically state:

“Server rooms must never be located near public areas.”

However, it says critical equipment should, where practicable, be located away from areas assessed as higher risk and should be concealed and protected.

Consultant’s perspective

For new premises, it is generally better to consider security during space planning rather than locating a critical room based solely on convenience and attempting to compensate later with additional electronic controls.

Room placement can itself be a security control.

Should critical equipment rooms be concealed?

ABS expressly says critical equipment should, where practicable, be concealed and protected.

This does not necessarily mean literally hiding the room.

The wider principle is that critical infrastructure should not be unnecessarily exposed to higher-risk areas or obvious unauthorised access.

Consultant’s perspective

This can also affect matters such as:

• signage;
• public-facing layouts;
• visitor routes; and
• contractor access.

The precise treatment should follow the risk assessment.

What security controls does ABS recommend for Critical Equipment Rooms?

ABS specifically states that rooms housing critical equipment should have adequate protection such as:

CCTV surveillance, door-access-control hardware and systems, and intrusion-detection systems.

It also says access should be restricted to authorised personnel only.

This is one of the clearest room-specific security recommendations in the guideline.

The controls work together:

The table expresses the practical functions of those controls; ABS does not present them in this exact table format.

Does ABS require card access on server rooms?

ABS says rooms containing critical equipment should have adequate protection including door access-control hardware and systems, and access should be limited to authorised personnel.

The guideline does not, however, state that every room called a server room must use one specific credential technology.

The access-control design should correspond to the room’s risk and criticality.

Does a server room require 2FA?

Not automatically.

ABS says access points to restricted or critical areas should be designed with complementary controls such as:

• 2-Factor Authentication;
• intrusion detection; and/or
• audible alarm systems.

The separate access-control section also states that stronger access-control measures at sensitive or critical areas may include:

• card + PIN;
• card + biometric;
• anti-passback; and
• interlocking door controls.

However, this should not be converted into:

“ABS requires 2FA on every server room.”

The guideline links stronger controls to sensitive or critical areas, with actual design following risk.

When might 2FA be appropriate for a technology room?

A practical assessment could consider:

• criticality of systems;
• consequence of unauthorised access;
• amount of sensitive infrastructure;
• number of authorised users;
• whether the area is staffed or unattended;
• after-hours access;
• incident history; and
• organisational risk appetite.

For a highly critical data hall, the justification for stronger authentication may be greater than for a small low-impact communications cupboard.

That is consultant interpretation based on ABS’s risk-based approach.

Does ABS require CCTV at server rooms?

ABS lists the following among typical CCTV surveillance locations:

• critical equipment rooms;
• technology rooms; and
• data halls.

The Critical Equipment Room section also specifically identifies CCTV as one of the protective measures that may form part of adequate protection.

This provides strong support for considering CCTV around critical technology spaces.

Should CCTV cover inside the server room or just the entrance?

The ABS guideline does not specify one universal rule that the camera must always:

• be inside the room;
• face the door from outside; or
• provide both views.

It identifies critical equipment rooms and technology rooms as typical CCTV locations but does not give an exact camera placement layout in this section.

Consultant’s perspective

The camera objective should first be established.

For example:

Entrance camera

May support identification and verification of people entering.

Internal camera

May provide information about activity around equipment inside the room.

Whether one or both are required should depend on risk, privacy considerations, layout and the surveillance objective.

Does ABS specify the camera resolution for server rooms?

No universal server-room resolution is specified in the ABS CCTV section.

ABS refers financial institutions to GEBSS and the SPF Video Surveillance System Standard for Buildings for more detailed CCTV technical guidance.

Therefore, statements such as:

“ABS requires 4MP cameras in server rooms”

would not be supported by the ABS document itself.

The required camera performance should instead be determined from the required surveillance outcome and applicable technical guidance.

Should a server room have intrusion detection?

Where the room is restricted or critical, ABS supports this.

The Critical Equipment Room section identifies intrusion detection as one of the protective measures for critical rooms.

The Internal Access Points section also recommends considering intrusion detection and/or audible alarm systems at restricted or critical areas.

Again, the precise device and alarm logic are not prescribed in this section.

What type of intrusion sensor should be used?

The Critical Equipment Room section does not specify which intrusion sensor must be installed.

Elsewhere, ABS gives examples of intrusion/alarm devices such as:

• door contacts;
• motion detectors;
• seismic detectors; and
• other alarm devices.

The actual selection should be based on what type of intrusion or breach needs to be detected.

For example, door-state detection and internal movement detection perform different functions.

Should server-room intrusion alarms be monitored?

ABS’s wider intrusion-detection guidance states that effective intrusion detection must be complemented by monitoring and response.

Therefore, simply installing a sensor that nobody receives or responds to would not align well with the overall ABS detection philosophy.

Consultant’s perspective

For a critical technology room, the full workflow should be understood:

Alarm → Monitoring → Verification → Escalation → Response

The response might involve on-site security, building security, IT personnel or another responsible team depending on the event.

Should access to Critical Equipment Rooms be restricted?

Yes.

ABS specifically states that access to critical equipment rooms should be restricted to authorised personnel only.

This means access should follow legitimate operational need.

A person having general office access does not automatically need access to critical infrastructure.

Should access rights be role-based?

ABS recommends security-level zoning with role-based access privileges elsewhere in its access-control guidance.

For critical technology spaces, this supports limiting access to the relevant authorised groups.

Consultant’s perspective

For example, access could potentially be divided between:

IT Infrastructure

Technology systems.

Facilities

Supporting M&E infrastructure.

Security

Emergency or authorised operational access.

Approved contractors

Temporary access only when necessary.

The actual groups should reflect the FI’s operating model.

Should server-room access logs be reviewed?

ABS says that for sensitive or critical areas, the FI should review door-access logs for potential access violations or suspicious activities.

Where a server room has been classified as sensitive or critical, this principle would be directly relevant.

Consultant’s perspective

Useful events might include:

• unusual after-hours access;
• repeated denied access;
• access by persons outside the expected role;
• activity during periods when the room should be unoccupied; or
• events associated with another alarm.

The FI should define what events warrant review and escalation.

Does ABS require anti-passback on server rooms?

No universal requirement.

ABS lists anti-passback among stronger access-control measures that may be used for sensitive or critical areas.

Whether it is appropriate for a particular server room or data hall should depend on:

• access workflow;
• security level;
• operating requirements; and
• risk.

Does ABS require biometrics for server rooms?

No.

ABS gives card + biometric as one example of 2FA for sensitive or critical areas. It also gives card + PIN as another example.

Therefore:

“ABS requires biometric readers for server rooms”

would be incorrect.

Biometric authentication is one possible stronger access-control method, not a universal server-room requirement.

Do data halls require stronger access control?

ABS specifically identifies data halls as an example of a sensitive or critical area where stronger access-control measures should be deployed.

Those measures may include 2FA, anti-passback or interlocking door controls.

This is more explicit than the guideline’s wording for a generic office server room.

A data hall should therefore be assessed as a potentially higher-security space.

Does ABS require a man-trap for data halls?

No universal requirement.

ABS includes interlocking door access controls or man-traps among examples of stronger controls for sensitive or critical areas.

The Internal Access Points section similarly says specially protected entrances such as gates, interlocking systems or portals may be required depending on the risk assessment.

The risk assessment therefore remains the deciding factor.

Does the physical wall around a server room matter?

Yes, conceptually.

A strong access-control system protects the door, but the room’s overall physical boundary also matters.

ABS says walls and partitions separating public and restricted areas form an important part of the building’s overall protective capability.

It discusses floor-to-ceiling slab partitioning as a way of increasing resistance to access through raised floors or above suspended ceilings and also notes that intrusion detection may supplement physical barriers.

This is especially relevant where a critical room has a strong locked door but is surrounded by easily bypassed lightweight partitions.

Does ABS require concrete walls around every server room?

No.

ABS discusses stronger wall construction within its broader walls-and-partitions guidance but does not say:

“Every office server room must have reinforced-concrete walls.”

The required construction should follow:

• room criticality;
• identified threat;
• building design;
• risk assessment; and
• applicable technical requirements.

The guidance should therefore not be converted into a universal specification.

What about access above the ceiling or below the raised floor?

ABS specifically notes that floor-to-ceiling slab partitioning can increase resistance to forced entry via:

• raised floor spaces; or
• areas above ceiling boards.

Consultant’s perspective

This highlights a common security-design mistake:

protecting only the door.

For a critical room, the full security envelope should be considered:

door + frame + walls + ceiling interface + floor interface + locks + detection

where relevant to the risk.

Should critical rooms be protected after office hours?

ABS says off-operational-hours security controls should be considered when designing internal access controls.

This is particularly relevant to unattended technology and critical-equipment spaces.

Consultant’s perspective

After hours, a room might rely on a combination of:

• electronic access control;
• intrusion detection;
• CCTV;
• remote monitoring; and
• building-security response.

The precise arrangement depends on the site’s risk and operating model.

What if the critical equipment belongs to the landlord?

This is directly addressed by ABS.

If critical equipment rooms form part of building infrastructure managed and maintained by building management, the FI should include them in its risk assessment as Critical Assets supporting FI operations.

This is an important point.

The FI does not need to own a critical asset for its failure to create risk.

Which landlord-controlled rooms might matter to an FI?

Depending on the building and FI operations, these could potentially include:

• telecommunications infrastructure;
• electrical rooms;
• central UPS or generator infrastructure;
• cooling or air-handling systems;
• network-related rooms;
• fire-protection infrastructure; or
• other building systems supporting the tenancy.

These examples follow the categories identified by ABS, but which specific rooms are critical must be established for the actual premises.

Does the FI need access to landlord critical rooms?

Not necessarily.

ABS says they should be assessed as critical assets supporting the FI where appropriate. It does not say FI personnel must automatically be given access to those rooms.

The FI may instead need to understand:

• who controls access;
• what physical protection exists;
• whether CCTV or alarms exist;
• how incidents are monitored;
• what resilience exists;
• and how the FI will be informed if the system fails.

This is a security-dependency review rather than an access request.

Should landlord critical infrastructure be reviewed before signing a lease?

ABS’s wider guidance supports considering building and infrastructure risks during site selection and pre-lease assessment.

Consultant’s perspective

For a major financial institution relocation, it makes sense to understand critical building dependencies before committing to the location.

The review might identify a situation where the FI plans a highly resilient office internally but depends on poorly protected shared infrastructure outside its tenancy.

That is precisely why the wider building environment matters.

Is a Critical Equipment Room the same as a data centre?

No.

A Critical Equipment Room can be a room supporting essential facility services.

A data centre is a much larger and potentially more complex type of critical facility.

ABS specifically distinguishes between different types of premises and notes that critical facilities such as data centres may require different protective measures from ordinary offices.

The same risk-based principles apply, but the scale and security requirements can be different.

Is a telecommunications room automatically the same as a data hall?

No.

The ABS guideline uses different terms for different contexts:

Telecommunications room appears as an example of a Critical Asset.

Technology rooms and data halls appear among typical CCTV locations.

Data halls also appear as an example of areas warranting stronger access control.

These should not automatically be treated as interchangeable terms.

What is the minimum ABS security package for a server room?

ABS does not publish a universal package saying:

“Every server room requires one card reader, one camera, one motion sensor and 2FA.”

Instead, the guideline establishes risk-based principles.

For a room assessed as critical, the key controls discussed by ABS include:

restricted authorised access + access control + CCTV + intrusion detection + appropriate physical protection.

Additional controls such as 2FA, anti-passback or interlocking entrances depend on the sensitivity and risk.

Common mistakes when interpreting ABS guidance for server and critical rooms

“Every server room is automatically a Critical Asset.”

Not necessarily. Criticality depends on the consequences of loss or damage.

“ABS requires biometric access to server rooms.”

No. Biometrics is one possible form of stronger 2FA.

“ABS requires 2FA on every server room.”

No. ABS associates stronger controls with restricted or critical areas and retains a risk-based approach.

“ABS requires a camera inside every server room.”

ABS identifies critical equipment rooms and technology rooms as typical CCTV locations but does not specify one universal inside-camera arrangement.

“If the landlord owns the electrical or telecommunications room, it is outside the FI’s security scope.”

No. ABS specifically says relevant landlord-managed critical rooms should be included in the FI’s risk assessment.

“A strong door is enough.”

Not necessarily. ABS uses a layered approach involving physical barriers, access control, CCTV, intrusion detection and response.

“A reader on a lightweight partition creates a high-security room.”

The surrounding physical envelope must also be considered.

A practical critical-room security design process

A financial institution can approach each technology or infrastructure room through the following sequence.

1. Determine what the room supports

Identify the equipment, systems and operations dependent on it.

2. Determine criticality

Assess what happens if the room or equipment is damaged, destroyed or made unavailable.

3. Identify threats

Consider unauthorised access, forced entry, sabotage or other applicable threats identified by the RA.

4. Review location

Determine whether the room is unnecessarily exposed to public or higher-risk areas.

5. Review the physical envelope

Assess door, frame, wall, ceiling and floor vulnerabilities.

6. Define authorised personnel

Determine exactly which roles genuinely require access.

7. Select access-control strength

Determine whether normal credential access is adequate or stronger authentication is justified.

8. Determine CCTV requirements

Define the required surveillance purpose and camera coverage.

9. Determine intrusion detection

Identify what breach conditions need to generate an alarm.

10. Define monitoring and response

Establish who receives and responds to security events.

11. Review landlord dependencies

Identify critical infrastructure outside the FI’s own tenancy.

12. Test and periodically review

Confirm that access, CCTV, alarms and response continue to operate as intended.

That sequence follows the ABS risk-based philosophy while leaving detailed engineering to the applicable standards and project requirements.

Practical Critical Equipment / Server Room Security Checklist

A financial institution reviewing a critical technology room should be able to answer:

• What operations does the room support?
• Is it a Critical Asset?
• What happens if the room is lost?
• Is its location appropriate?
• Is it unnecessarily visible or exposed?
• Is access restricted to authorised personnel?
• Who specifically is authorised?
• Is electronic access control required?
• Is stronger authentication justified?
• Is 2FA required by the risk assessment?
• Is anti-passback justified?
• Does CCTV cover the required activity?
• Is the camera intended for identification, observation or investigation?
• Is intrusion detection required?
• What alarm event is being detected?
• Who monitors the alarm?
• Who responds?
• Are after-hours controls adequate?
• Are the door and frame appropriate?
• Can the room be bypassed through the surrounding partition?
• Is the ceiling or raised-floor interface relevant?
• Are access logs for the critical room reviewed?
• Does the FI depend on landlord-controlled electrical, cooling, telecommunications or fire-protection infrastructure?
• Have those dependencies been included in the risk assessment?
• Are security controls periodically tested and reviewed?

Conclusion

The ABS guideline gives Critical Equipment Rooms particular attention because failure of the infrastructure they contain can have consequences far beyond the physical room itself.

Critical equipment can include systems supporting:

power, water, air supply, communications, networks and fire protection.

ABS says such equipment should, where practicable, be located away from higher-risk areas, concealed and protected. Rooms containing critical equipment should have appropriate protection such as CCTV, access control and intrusion detection, with access restricted to authorised personnel.

It also makes an important point for financial institutions occupying leased premises:

Critical infrastructure does not stop at the tenant boundary.

Building-managed critical equipment that supports the FI should also be considered within the FI’s risk assessment.

The key principle is therefore:

Do not protect a room simply because it is called a server room. Protect it according to what would happen to the business if the systems inside it were compromised or lost.