Domain 3 of 8 · Chapter 9 of 10

Facility Security Controls

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

  • Why facility controls are an availability problem
  • Restricted areas: wiring closets, server rooms, media and evidence storage
  • Fire: detection, classes, and the suppression decision
  • HVAC, humidity, and power: keeping equipment alive
  • Exam-pattern recognition

Fire-suppression pipe configurations and when to use them

SystemPipe state at restWhat triggers water flowBest fit
Wet pipeAlways full of waterHeat opens an individual sprinkler headGeneral-purpose occupied space; cheapest, simplest
Dry pipeFilled with pressurized airHead opens, air bleeds, then water entersUnheated spaces where wet pipes could freeze
Pre-actionDry until a detector pre-arms itDetector AND a head must both tripData centers / server rooms. Guards against a single accidental break
DelugeDry, with all heads openDetector floods every head at onceHigh-hazard areas needing instant total coverage; never a server room

Decision tree

Energized electronics in the space (Class C risk)? Yes Clean agent FM-200 / inert gas; no residue No / water required Freeze-prone or high-hazard? Neither (data center) Pre-action detector + head both trip; default Which hazard? Freeze risk Dry pipe air-charged; won’t freeze High-hazard Deluge all heads flood at once General-purpose occupied space with none of the above: wet pipe (simplest, always charged) Always pair any system with early smoke detection
Cheat sheet

Cheat sheet

  • Facility environmental controls protect availability first
  • Lock and log wiring closets (IDF/MDF) even though they're unstaffed
  • Evidence storage adds chain of custody on top of media storage's environmental controls
  • Combustion needs four things. The fire tetrahedron
  • The class of fire dictates the only safe agent
  • De-energize or use a non-conductive agent before fighting an electrical fire
  • Prefer a clean agent over water around live electronics
  • Halon was banned for ozone depletion; FM-200 and inert gas replaced it
  • Pre-action sprinklers are the data-center default because they guard against accidental discharge
  • Know the four sprinkler pipe configurations by their pipe state
  • Match the fire detector to the fire signature you need caught earliest
  • Hot-aisle/cold-aisle keeps supply and exhaust air from mixing
  • Keep server-room humidity in band. Both extremes damage hardware
  • Low humidity means static; high humidity means condensation
  • Maintain positive air pressure to keep contaminants out
  • Raised floors route power and chilled air but hide water
  • Build power in three layers: condition it, ride the gap with a UPS, then run the generator
  • A UPS is bridge power, not long-run power. It buys time for the generator
  • Express power redundancy as N+1 up to 2N
  • Use the exact power-anomaly term. Under-voltage, over-voltage, or loss, momentary or prolonged
  • Plan facility controls against natural, man-made, and political threats
  • Tune biometrics by FAR vs FRR; compare systems by CER
  • Dual-technology motion sensors cut false alarms with AND logic
  • Counter vehicle-borne attacks with crash-rated standoff barriers

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. CISSP - Certified Information Systems Security Professional (exam outline / domains)
  2. NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations (Physical and Environmental Protection family) Whitepaper
  3. NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization Whitepaper
  4. NIST Fire Research Division (fire dynamics, detection, and suppression research)