Insights · Field note · Infrastructure and resilience
Power, cooling and the security team
A failed chiller takes down more systems than most attacks. Environmental controls belong in the security program, not in a separate building.
Power and cooling failures stop services as completely as any attack and are more common. They belong in the security program because the frameworks say so, NIST SP 800-53 and SP 800-171 both include physical and environmental protection, and because the security team already owns the disciplines that manage them: monitoring, alerting, maintenance governance, vendor oversight and recovery testing. The practical work is knowing the facility’s power and cooling design and its single points of failure, monitoring environmental conditions with alerts that someone acts on, governing maintenance of the plant like any other window, and including environmental failure scenarios in recovery and continuity exercises.
In detail
What the evidence shows.
Why it is a security matter
Availability is a security property. A chiller failure that overheats a server room, a transfer switch that fails to transfer, a generator that starts and stops, and a maintenance contractor who disconnects the wrong feed each produce an outage with the same consequence as a destructive attack, and sometimes with the same cause.
Know the design
How many utility feeds, how many UPS strings and for how long, how many generators and how much fuel, how cooling is redundant and where it is not. Most facilities have a design document; fewer have verified it against what is installed and maintained. The single points of failure in the plant go on the same list as those in the network.
Monitor and respond
Temperature, humidity, power quality, UPS and generator status, leak detection, feeding alerts to the same operations function that handles security alerts, with a response procedure. An environmental alert that goes to a facilities mailbox nobody reads at night is a finding.
Maintain and test
Plant maintenance under the same window discipline as system maintenance, with vendors verified and work logged. Generator and transfer tests on a schedule with records. Environmental failure scenarios in tabletops and recovery tests. See critical infrastructure support, physical access control and the data centers and infrastructure industry page.
Sources
Primary references.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (physical and environmental protection and configuration management families)
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (physical protection and configuration management requirements)
- Performance Data engagement observations (first-hand: David Selakovic); method described under Infrastructure Resilience.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days