Three Questions Before You Touch Anything

A suspicious camera in the parking lot and a suspicious cooling controller in Hall B are both alerts. They are very different decisions.

Before anyone acts, three questions decide what happens next.

Question one: What can it reach?

Can this device reach the building management system? The power monitoring system? The tenant network? The internet? Another facilities zone?

A device with few connections may give an attacker fewer places to go. But it can still be critical if it controls cooling, power or an alarm. Check what it does as well as what it can reach.

Question two: What breaks if it fails?

Could losing this device cut cooling capacity? Hide power readings? Silence an alarm? Lock staff out of a room? Delay a fire response? Break a tenant's service?

This is the question security teams usually can't answer alone. Facilities can. That's why the answer needs to be written down before the night it's needed.

Question three: Can we safely change it right now?

Is there a backup unit carrying the load? Is this a maintenance window? Does a facilities engineer or the vendor need to be on site? Has this exact action been approved ahead of time?

If the answers are unclear, the right move may be to watch closely and call the right person. If they're clear, act fast.

Why process is uptime

INDEPENDENT EVIDENCE

Uptime Institute's 2026 outage analysis found that power is still the leading cause of serious data center outages. UPS systems, transfer switches and generators lead the list.⁷

The same research found something just as important. When people cause outages, the most common reason is that someone didn't follow an established procedure.

That matters for security. A rushed, unplanned security action near power or cooling is exactly the kind of change that causes outages.

Write down the approved response while the team has time to review it. At 2:00 a.m., that gives the person on call a plan to follow.