Subscribe to Our Digest
By Steve Barton, Director of Business Development, Acre Security
The rapid buildout of AI infrastructure is changing the face of data center operations. Instead of a handful of large campuses, operators are now dealing with many smaller facilities and edge-POPs — locations that still house critical equipment but run with smaller teams onsite and far more contractor movement.
With every new site, there are more doors, more privileged zones, and more credentials to manage. What used to be a single, tightly controlled environment has become widely distributed, with people traveling continuously between facilities.
This expansion is stretching traditional access-control architecture beyond what they were designed for. The challenge is no longer who can open which door. It’s how to maintain consistent policy, revocation discipline, and auditability across dozens of facilities in real time.
When people think of physical compromise of a data center, they often imagine sophisticated external attackers. In practice, most risk comes from inside the system — credential drift, over-permissioned staff, contractors who retain access longer than intended, and local “exceptions” that are never rolled back.
In my forty years building access systems for banks and critical infrastructure, the pattern has been remarkably consistent: security incidents and avoidable downtime often stem from weak operational discipline, not headline-grabbing attacks. A single outdated badge, an exception added during a maintenance period and then forgotten, or a zone permission that was never revoked can create exposures every bit as damaging as a deliberate intrusion.
Distributed sites multiply that risk. Each remote POP or satellite building increases the potential for divergence, where one location’s security practices slowly drift away from what policy requires. Without strong central governance, operators cannot assume that physical security acting uniformly across their estate.
Before adding anything new, the basics have to work: doors have to open and close reliably, alarms have to trigger locally even if the site temporarily loses connectivity, and people must only move through the areas they’re authorised. No amount of analytics or cloud orchestration can compensate for a door that doesn’t lock, an unreliable reader, or a zone boundary that is unclear to staff and contractors.
Modernization still begins with making sure that each site, no matter how small, is secure at the physical level. Clean door hardware and controller installs, clear zoning and permissions design, local alarm paths that work without a WAN link – only once this base layer is robust does it make sense to add cloud and edge intelligence.
For multi-site deployments, cloud management is rapidly becoming the default. It directly addresses the consistency problems that appear as soon as operators expand beyond a single location.
Practical takeaway: if you operate more than a handful of sites, managing identities and permissions locally at each building is no longer sustainable. A cloud-based identity and policy layer is the simplest way to enforce “one version of the truth”.
A regulated electricity utility in Canada offers a useful template for data-centre operators facing similar challenges.
The company operates operations buildings, warehouses, control centres, data centers and substations across a large metropolitan area. Over time, an on-premises access-control system that once worked well for a smaller footprint had become a constraint. The security team needed to:
The utility chose to migrate to a cloud-based Acre access control solution, working with its existing integrator to minimise disruption. Rather than rip-and-replace everything at once, they:
The impact was operational rather than purely technical:
For data center and edge operators, the lesson is straightforward: moving access control into the cloud is not just an IT refresh. Done properly, it is a chance to standardise how identities, roles and physical movement are governed across all facilities.
Distributed sites have an Achilles heel that large campuses rarely do: they can be isolated. Network links go down, power issues occur, or a site loses connectivity for reasons outside the operator’s control. When that happens, the access system still has to function.
As access systems evolve, the controller becomes the critical component. For distributed, edge-heavy environments, modern controllers should be designed with the future in mind:
For operators modernising access control across a mixed core-and-edge estate, a clear order of operations emerges:
Distributed data center environments need both consistency and resilience. Cloud management provides consistency. Edge intelligence provides resilience. Together, they allow operators to secure every facility, regardless of size — from flagship campuses to remote POPs — with the reliability expected of critical infrastructure.