Security for Telecom & Data Centre Facilities: Physical Access, CCTV & Fire Safety

Data centres and telecommunications facilities are among the most security-sensitive environments in Bangladesh's commercial landscape. They house the infrastructure that underpins banking transactions, mobile communications, internet services, and government systems. A physical security failure — an unauthorised access event, a fire, or equipment damage — can cause cascading failures affecting millions of users and billions of taka in economic activity.

Physical security at these facilities is not a cost centre to be minimised. It is a fundamental operational requirement, driven by both the economic value of the infrastructure and the compliance requirements of BTRC (Bangladesh Telecommunication Regulatory Commission), cloud service standards (AWS, Azure, Google Cloud all have physical security requirements for co-location facilities), and international certifications (Tier III and Tier IV classifications from the Uptime Institute, ISO 27001).

This guide explains the physical security and fire safety architecture appropriate for Bangladesh data centres and telecom facilities.

Telecom Facility Security Requirements

Bangladesh's telecommunications sector is regulated by BTRC under the Bangladesh Telecommunication Regulatory Commission Act 2001. BTRC-licensed operators — Grameenphone, Banglalink, Robi, Teletalk, and fixed-line and ISP operators — must maintain their network infrastructure to BTRC standards, which include provisions for physical security of telecommunications equipment.

BTRC guidelines and the operators' own network operating standards require:

Controlled access to network facilities: All network equipment rooms, mobile cell site equipment cabinets, and exchange facilities must have controlled access. For unmanned remote sites (cell towers, exchange huts), this means locked cabinets with tamper detection and alarm monitoring. For manned facilities (major exchanges, NOCs), this means access control systems with audit logging.

24/7 monitoring for critical facilities: Primary network switching centres, network operations centres (NOCs), and major data centres must have 24/7 human monitoring or remote monitoring with automated alert systems.

Incident reporting: Security incidents affecting telecom infrastructure must be reported to BTRC within defined timeframes. Physical security breaches that affect service availability may constitute reportable incidents.

Multi-Layer Access Control: Perimeter to Rack Cabinet

The security architecture for a Bangladesh data centre or major telecom facility follows a concentric defence model — each layer of physical security is independent of the others, so that a failure at one layer does not automatically compromise inner layers.

Layer 1: Site Perimeter

The outer boundary of the facility — fence, wall, or building boundary — is the first security layer. For dedicated data centre campuses (as opposed to data floors within multi-use buildings), the perimeter should include:

Physical barrier: Masonry wall or purpose-built security fence (anti-climb design) with topping (rotating spikes, anti-climb paint, or security wire) where appropriate for the risk level.

Perimeter intrusion detection: Vibration cable detection on the fence line, or microwave beam detectors spanning the perimeter, provide automated intrusion detection. Perimeter breach alerts are sent to the facility's security monitoring station.

CCTV along perimeter: Thermal IP cameras (for night detection) supplemented by fixed HD cameras on fence line pillars provide continuous perimeter visibility. PTZ cameras at gates enable remote inspection of approaching vehicles and persons.

Perimeter lighting: Security lighting that activates on motion detection along the perimeter fence and on all external walls deters after-hours intrusion and supports CCTV image quality.

Layer 2: Site Access (Vehicle and Pedestrian)

Vehicle and pedestrian entry to the facility site requires:

Vehicle gate with ANPR: Boom barriers at all vehicle entry/exit points, controlled by an ANPR camera that reads approaching vehicle licence plates. Pre-registered vehicles (staff vehicles, regular contractors) enter automatically. Unregistered vehicles must be processed by security staff through an intercom and manual verification process.

Anti-ram protection: For high-security facilities (primary data centres, NOCs), crash-rated barriers (bollards or wedge barriers) supplement the boom barrier to prevent vehicle ramming attacks.

Pedestrian access control: Staff enter via separate pedestrian gates or turnstiles, authenticated by RFID card plus PIN or biometric (fingerprint). Visitor pedestrian access is through the manned security guardhouse.

Security guardhouse: A staffed security position at the main vehicle gate controls all vehicle and visitor access. The guardhouse has CCTV monitors showing live feeds from perimeter cameras and entry/exit cameras, and maintains the visitor log for the facility.

Layer 3: Building Envelope

The data centre building envelope — all exterior walls, doors, and the roof — forms the third security layer.

All external doors: Every external door must be access-controlled (card or biometric access for staff; no exterior handle for preventing entry from outside on fire exit doors — panic hardware only on the interior). External door contacts (monitored to the security system) detect any door that is left open or forced.

Man-trap or airlock entry: The main staff entry to a high-security data centre uses a man-trap — a small enclosed space between two doors, where only one door can be open at a time. A person entering presents their credential to the outer door; only after the outer door closes does the inner door allow access. This prevents tailgating (two people entering on one credential).

Layer 4: Data Hall Floor

Access to the data hall floor — where servers, storage, and networking equipment are housed — is the most restricted access layer in the data centre.

Biometric plus card access: Two-factor authentication at the data hall entry door. Staff must present both their access card and a biometric credential (fingerprint or iris). Both factors must be valid for the same person — the card and biometric must match the same user account.

Visitor access to data hall: Visitors to the data hall (clients inspecting their equipment, vendor engineers performing maintenance) must be pre-authorised, escorted by a permanent staff member, and their access logged separately (time in, time out, equipment or rack area visited, staff escort identity).

Anti-tailgate detection: For very high security data halls, floor-level weight or optical anti-tailgate systems detect when more than one person is present in the single-authentication zone and prevent the inner door from opening until the zone is clear.

Layer 5: Individual Rack or Cabinet

The innermost security layer is the individual server rack or cabinet, relevant primarily in co-location data centres where different clients share the same data hall floor.

Individually locked cabinets: Each client's cabinet has its own physical lock — either a mechanical key lock or an electronic lock with client-specific credentials. The electronic lock logs every cabinet opening.

Smart cabinet management: Premium co-location facilities provide clients with remote management of their cabinet lock — the client can remotely authenticate a maintenance engineer's access to their specific cabinet, creating a time-limited credential for that engineer to open that cabinet during a defined maintenance window.

CCTV with 90-Day Retention for Compliance

Data centre CCTV requirements are the highest of any commercial building type. Coverage must be complete — no blind spots in the data hall floor or in any equipment area. Retention must be adequate for the incident investigation timelines of the industries served.

Coverage requirements:

• 100% coverage of the data hall floor — every aisle must be visible. A combination of fixed cameras at aisle ends and PTZ cameras covering multiple aisle views achieves this.
• All entry and exit points — including emergency exits, loading bays, and roof access hatches.
• Perimeter and site access (as described above).
• Security operations centre and management areas.
• Generator room, UPS room, and electrical distribution room.

Resolution requirements: Data centre CCTV should use minimum 4 MP cameras in the data hall. High resolution is needed to identify equipment labels, rack positions, and the specific equipment being touched during maintenance activities. This level of detail is important for investigation of any equipment tampering incident.

Retention: 90-day minimum for all data centre CCTV. Many international co-location standards (SOC 2, ISO 27001) require this retention level. Bangladesh Bank requires 90-day retention for bank data centres. BTRC guidelines align with this benchmark.

Redundant storage: CCTV footage must be stored redundantly — RAID storage within the NVR, or dual-path recording to separate storage locations. A single NVR hard drive failure must not result in footage loss.

Environmental Monitoring: Temperature, Humidity, Water Leak, and Smoke

Data centre equipment is sensitive to temperature excursions, humidity, water ingress, and particle contamination. Environmental monitoring systems detect these conditions before they cause equipment damage.

Temperature and humidity monitoring: Sensors placed at regular intervals throughout the data hall (both hot aisle and cold aisle), in every IT equipment room, and in UPS and battery rooms. Temperature alerts at user-defined thresholds (e.g., alert at 28°C in cold aisle; critical at 32°C). Humidity alerts for both high humidity (condensation risk above 60% RH) and low humidity (static electricity risk below 20% RH).

Water leak detection: Linear water detection cable placed at the underfloor level (below raised floor tiles) detects water ingress from CRAC unit condensate leaks, plumbing failures, or external water ingress. When the cable contacts water at any point along its length, it signals the exact location of the leak to the environmental monitoring system.

Smoke detection: Very Early Warning Aspirating Smoke Detection (VESDA) — a system that actively draws air samples through a pipe network to a central detector — provides smoke detection sensitivity far exceeding conventional point detectors. VESDA can detect smoke concentrations as low as 0.001% obscuration per metre — detecting a developing fire in its incipient stage, before it becomes visible to the human eye. This very early warning allows intervention (locating and isolating the equipment fault) before a fire develops.

Airflow monitoring: Differential pressure sensors monitor the air pressure differential between hot aisle and cold aisle in the data hall, detecting CRAC unit failures or blocked airflow paths that could cause localised hot spots.

All environmental monitoring data is presented in a real-time dashboard accessible to the data centre operations team, with automated alerting (SMS and email) to the on-call engineer for all alarm conditions.

Clean Agent Fire Suppression for Server Rooms

Water-based fire suppression is entirely inappropriate for data centres and server rooms. Water damages electronic equipment instantly and catastrophically. Clean agent suppression systems suppress fire by a chemical or physical mechanism that does not involve water or other residue-leaving agents.

FM-200 (HFC-227ea): A hydrofluorocarbon agent that suppresses fire by absorbing heat from the combustion reaction. FM-200 discharges rapidly (10 seconds at design concentration), is safe for occupied spaces at design concentrations, and leaves no residue. FM-200 is the most widely installed clean agent system in Bangladesh data centres and telecom equipment rooms. FM-200 has a global warming potential and is subject to phase-down under international environmental agreements — new installations should consider Novec 1230 as an alternative.

Novec 1230 (3M): A fluoroketone agent with very low global warming potential. Novec 1230 has similar suppression properties to FM-200 — rapid discharge, safe for occupied spaces, no residue — with a more favourable environmental profile. It is increasingly preferred for new data centre suppression system installations.

Double-knock detection: To prevent accidental discharge (a single faulty smoke detector should not trigger a suppression discharge), clean agent systems use a double-knock activation sequence. Two independently triggered detectors (typically one ionisation type and one photoelectric type) must both activate before the suppression agent releases. This dual-detector requirement dramatically reduces false discharges.

Pre-discharge warning: A 30-60 second pre-discharge warning (audible alarm and strobes in the protected room) allows personnel to evacuate before the agent discharges. Manual abort button allows trained staff to cancel the discharge if the alarm is confirmed as false during this window.

Bangladesh Data Centre Context: Tier III Requirements

Bangladesh's commercial data centre market is served by a growing number of Tier III class facilities, including those operated by Grameenphone, Banglalink, BDCOM Online, and dedicated co-location operators. Tier III certification (from the Uptime Institute) requires:

• Multiple independent power and cooling distribution paths with only one path active
• All equipment is maintainable without shutting down the facility (concurrent maintainability)
• 99.982% availability (less than 1.6 hours of unplanned downtime per year)

Physical security is not explicitly included in the Uptime Institute's Tier certification requirements, but it is implicitly required — a facility cannot achieve 99.982% uptime without physical security adequate to prevent unauthorised access events that cause service disruptions.

For Bangladesh data centres seeking ISO 27001 certification (the information security management standard), physical security is explicitly assessed under Control Domain A.11 (Physical and Environmental Security). The multi-layer access control, CCTV retention, environmental monitoring, and clean agent suppression systems described in this article directly satisfy the ISO 27001 physical security controls.

SSAL provides physical security system design, supply, installation, and AMC for data centre and telecom facility clients across Bangladesh. Our data centre security projects include access control, CCTV, environmental monitoring integration, and clean agent suppression system commissioning support.

Get Free Consultation — Contact SSAL's data centre security team to discuss your facility's requirements. We will assess your current physical security posture against Tier III and ISO 27001 benchmarks, and propose a security programme that meets your compliance requirements and operational risk management objectives.