Security risk guide
Data centre security risk assessment
Physical, personnel and supply chain security for the facilities that hold critical data.
A data centre security risk assessment examines the physical, personnel and supply chain threats to a facility that stores or processes data, from forced entry and insider misuse to the loss of power, cooling or connectivity, and tests whether its layered controls protect the halls, plant and people that keep it running. For many Australian operators it also supports obligations under the Security of Critical Infrastructure Act 2018, where data storage or processing is one of the asset classes that must maintain a critical infrastructure risk management program.
- Data storage or processing is one of the asset classes covered by the critical infrastructure risk management program (CIRMP) obligation under the SOCI Act.
- A CIRMP must address physical, personnel, supply chain and cyber hazards, so physical security is a legal requirement, not only a customer expectation.
- Insiders and contractors with legitimate access are often the most significant risk, so access management and credential control matter as much as fences.
- Critical plant, such as generators, fuel, cooling, substations and fibre entry, needs the same protection as the data halls.
What security obligations apply to data centres?
The CIRMP obligation under the SOCI Act applies to responsible entities for 13 classes of critical infrastructure asset, including data storage or processing assets.1 The Critical Infrastructure Risk Management Program Rules require the program to identify and manage material risks across cyber and information security, personnel, supply chain and physical security and natural hazards.2 The physical and personnel requirements are explained in Agilient’s CIRMP physical security playbook and CIRMP personnel security playbook.
Operators that host Australian Government data may also need certification under the Government’s Hosting Certification Framework, and many customers ask for evidence of an independent physical security review as part of their own assurance.
What does a data centre security risk assessment cover?
- Perimeter and approach: fencing, vehicle approach and standoff, gatehouse and delivery control.
- Layered access zones: from the lobby and mantrap to the data hall, cage and rack, with the controls at each layer matched to what it protects.
- Credentials and people: issue and return of access cards, visitor and contractor escort, critical worker identification and insider risk.
- Critical plant: generators, fuel storage, cooling, substations, battery rooms and fibre entry points.
- Detection and response: intruder alarms, CCTV coverage and retention, monitoring, and how quickly a credible response arrives.
- Shared facilities and natural hazards: colocation risks between tenants, flood, bushfire and extreme heat.
The method follows AS ISO 31000:2018, so the findings can feed directly into the CIRMP and the board’s annual report.
How Agilient supports data centre security
Agilient provides independent security risk assessments and physical security reviews for data centre operators and the agencies that use them. Examples include a PSPF roadmap and independent physical security review of an outsourced data centre for a Commonwealth agency, an internal management system audit for a global data centre operator and the revision of a data centre operator’s management system for recertification. Agilient is independent of equipment suppliers and installers.
Other security risk assessment guides: crowded places and events, construction sites, data centres, high-profile homes and the step-by-step security risk assessment process.
Free download
Free security threat and risk assessment template. An editable Word template that follows SA HB 167:2025 and AS ISO 31000:2018, with a threat assessment, a five by five risk matrix, a risk register and a treatment plan.
Reviewing a data centre or preparing for your CIRMP report?
A short briefing will show how your facility’s physical and personnel controls stand against the risk and the SOCI Act rules.
Data centre security FAQs
Is a data centre critical infrastructure in Australia?
What does a data centre security risk assessment cover?
Why does physical security matter for a data centre?
Does Agilient sell or install data centre security systems?
- MinterEllison, SOCI risk management program requirements now in effect, minterellison.com
- Federal Register of Legislation, Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006), legislation.gov.au
- Australian Government, Hosting Certification Framework, hostingcertification.gov.au