Independent supplier discoveryUS & UK launch markets / Evidence updated 2 Oct 2026
criticalsupply.Infrastructure starts here

Physical security & fire · Reviewed 19 September 2026

Procure outcomes—not a device list.

A neutral evidence framework for defining the risk basis, physical zones, access paths, detection, fire strategy, system interfaces, emergency response and acceptance before comparing providers.

Browse security & fire suppliers

Risk basis

Define the protected outcome before the equipment schedule

NPSA's data-centre guidance treats physical, personnel, supply-chain and cyber security as connected parts of one risk-management strategy. Start with the assets, threats, fire hazards, operating model and required outcomes; then make each bidder show where controls act, how they fail safely and what evidence will prove them.

Input 1

Risk and assurance basis

Record the facility, assets, people, services and information being protected; credible threats and fire hazards; required outcomes; legal and insurance inputs; accepted residual risk; and the authority that can approve each decision.
Input 2

Zones and access journeys

Map public, operational, customer, delivery, plant, data-hall and high-security zones. Define how staff, visitors, contractors, deliveries, equipment and emergency responders enter, move, wait, leave and are recorded.
Input 3

Perimeter and building paths

Include boundaries, gates, doors, roofs, loading areas, ducts, vents, drainage, cable pits, meet-me rooms and other service routes. Tie each path to a deterrence, delay, detection, response and recovery objective.
Input 4

Electronic and operating controls

Define credential issue and revocation, access rules, visitor handling, alarms, surveillance, monitoring, incident escalation, retention, time synchronisation, cyber-security, privacy and degraded or manual operation.
Input 5

Fire strategy and interfaces

Set the fire-risk basis, compartment and room boundaries, detection, alarm, suppression, shutdown, ventilation, power, cooling, water and life-safety interfaces. Name the responsible designer and approving authority for every assumption.
Input 6

Testing, emergency response and lifecycle

Define inspections, functional and integrated tests, witness points, drills, defect rules, maintenance, configuration changes, temporary works, incident evidence, handover, training and periodic reassessment.

Evidence matrix

Join every control to a risk, result and owner

Evidence set

Risk basis

Comparison record

Dated threat and fire-risk assessments, protected assets, hazards, operating assumptions, required outcomes, applicable obligations, approvals and accepted residual risks

Accountable input

Owner, security lead and fire-safety lead

Evidence set

Zone and route model

Comparison record

Plans for people, vehicles, deliveries, equipment, services and emergency access with boundaries, permissions, controls, escape and fallback routes

Accountable input

Security designer, fire engineer and operator

Evidence set

Physical measures

Comparison record

Locations, ratings or performance criteria, interfaces, installation records, tamper controls, inspection access and maintenance requirements

Accountable input

Design authority and package providers

Evidence set

Electronic controls

Comparison record

Access rules, identities and roles, alarm and surveillance coverage, logs, privacy basis, integrations, cyber controls, failure modes and retention

Accountable input

Security operations, IT and OT security

Evidence set

Fire and emergency controls

Comparison record

Cause-and-effect, alarm, suppression, shutdown, ventilation, isolation, escape, responder information, drills and recovery procedures

Accountable input

Fire-safety lead, facilities and responders

Evidence set

Acceptance and lifecycle

Comparison record

Approved scripts, calibrated instruments, raw results, defects, retests, training, maintenance, spares, change control and periodic review plan

Accountable input

Commissioning authority and operator

Market controls

Trace the rules and authorities for the actual site

United Kingdom

Keep the security and fire risk records current

NPSA recommends a risk-based, layered data-centre security approach. UK workplace guidance requires the responsible person to assess and regularly review fire risk, record findings, plan for emergencies and train people. Confirm the duties, enforcing authorities, building and fire rules, standards and insurer requirements for the actual nation, facility and work.
United States

Tailor controls and codes to the facility

NIST's physical and environmental control family provides a useful evidence map for access, monitoring, visitors, transmission paths, fire, power and water risks. NFPA 75 is dedicated to fire protection of information-technology equipment. Use the adopted codes, authority having jurisdiction and project specialists for the actual site; a federal control catalogue or standards title is not proof of compliance.

System interfaces

Keep two assurance chains connected

Physical security

Follow every route through every state

NPSA highlights perimeter, building, ducts, wastewater routes, cable pits, meet-me rooms and building-management systems. Test authorised, denied, forced, held-open, power-loss, network-loss, maintenance and emergency-access states without disclosing sensitive details in public records.
Fire and life safety

Test cause, effect and recovery together

Carry the approved fire-risk basis into detection, warning, suppression, shutdown, ventilation, isolation, escape, emergency access and recovery. HSE guidance stresses recorded responsibilities and realistic practice; each interface needs an owner, expected result and witnessed evidence.

Offer comparison

Compare risk, integration and lifecycle on one basis

01

Normalize the risk basis

Issue the same zones, journeys, hazards, threats, performance outcomes, interfaces and evidence requirements to every bidder. Product counts are not comparable when the protected scope differs.
02

Test the interfaces

Compare how access, surveillance, fire detection, suppression, power, ventilation, building controls, emergency release and operating procedures behave together in normal, fault, maintenance and emergency states.
03

Price the lifecycle

Include monitoring, licences, data storage, inspections, consumables, specialist maintenance, training, drills, false-alarm response, spares, updates, retests, change control and handback—not installation alone.

Build the research set

Connect the package to the directory

Use filtered records to identify organisations for further research, then issue the same risk basis and evidence matrix to every candidate. Directory inclusion is not proof of competence, design responsibility, product suitability, code compliance, accreditation, available capacity, response performance or successful delivery.

Physical Security & Fire suppliersDesign, Build & Commissioning suppliers
Design & BuildFit Out & CommissionOperate & Maintain

Primary references

Sources used for this guide

UK National Protective Security Authority — Data Centre Security
NPSA's data-centre guidance treats ownership, physical, personnel, supply-chain and cyber security as one risk-management problem for owners and users.
UK National Protective Security Authority — Physical perimeter and building risks
The owner guidance recommends a risk-based, layered approach and identifies data-centre-specific paths such as ducts, wastewater routes, cable pits, meet-me rooms and building-management systems.
NIST — Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 Rev. 5 includes physical and environmental controls for access authorisation, entry control, monitoring, visitor records, transmission media, emergency power, fire protection and water damage.
National Fire Protection Association — NFPA 75
The current 2024 standard is dedicated to fire protection of information-technology equipment and covers fire-protection approaches, construction, detection and suppression, utilities, emergency procedures and modular data centres.
UK Government — Fire safety risk assessments
The current workplace guidance requires the responsible person to identify hazards and people at risk, reduce risk, record findings, prepare an emergency plan, train people and review the assessment.
UK Health and Safety Executive — Emergency procedures
HSE connects effective emergency response with recorded responsibilities, realistic practice, alarms, escape, shutdown or isolation, competent people and coordination with emergency services and other employers.

Sources checked 19 September 2026. Requirements vary by threat, occupancy, equipment, facility, operating model, jurisdiction and contract; confirm the current security, fire, life-safety, privacy, engineering, insurance and legal obligations with the responsible specialists and authorities.