Data Center Security: Four Layers of Defense and Where They Sit in the Cost Structure

Where does data center construction money actually go?

Building a data center in Indonesia runs somewhere between USD 8 million and USD 9 million per megawatt of installed capacity, according to the Indonesia Data Center Investment Analysis Report 2026 from Research and Markets. That sits below the 2026 global average, reported at around USD 11.3 million per MW. Hendra Kusuma, chairman of IDPRO, puts the number at USD 9 million to USD 10 million per MW for the mechanical, electrical, and core and shell work alone (Kontan, August 2025). IT equipment not included.

One thing to settle before you read further. Every figure in this article is indicative, and it is only good for early planning, building a business case, or calibrating internal expectations. Actual costing for a data center has to come from a feasibility study run by an MEP consultant or an EPC contractor, based on site conditions, PLN power availability at that specific point, your target rated level, and the rack density you have in mind. The gap between a benchmark estimate and a feasibility study can reach tens of percent. We are laying out the cost structure here as context, not as a quote.

And to be clear from the start: SECOM does not build data centers. SECOM secures them. Power calculations, cooling, and building structure belong to MEP consultants and EPC contractors. Our work begins at the next layer, once the facility has to be guarded around the clock and every person who walks into the white space has to be accounted for.

CapEx components

Land and building

Land is the smallest slice of the total project, often under 10%, but location determines nearly everything that follows. When Kementerian Komdigi explained its site criteria for the national data center, it listed conditions such as no history of earthquakes or flooding, plus distance from crowded areas, airports, and rail lines. Those criteria trace back to SNI 8799:2019 and the international standard ANSI/TIA-942.

The building itself is not an ordinary warehouse. Thicker concrete slabs to carry rack loads, tighter floor flatness tolerances for raised floor, and a structure that accounts for seismic loading. For a site in Jakarta or Surabaya, that seismic requirement adds structural cost that never shows up in a normal commercial project.

Power: generators, UPS, switchgear

This is the biggest line item. Electrical systems absorb 40% to 45% of the construction budget according to Dgtl Infra, and redundancy configuration is the largest multiplier inside it. Moving from N+1 to 2N on the electrical side can add 40% to 60% to this category alone.

What's inside: medium voltage transformers and switchgear, UPS with battery banks, diesel generators with fuel storage, automatic transfer switches, PDUs and busway all the way to the rack. On plenty of Indonesian projects, the schedule driver isn't the building. It's when PLN can energize the connection.

Cooling

The tropics make this line more expensive than an equivalent facility in Japan or Europe. High humidity and outdoor temperatures that push past 35 degrees keep the cooling plant working harder year round, with no winter window for free cooling.

Rack density is climbing too. Uptime Institute recorded average global power per rack moving from 6.8 kW to 7.5 kW in its 2025 survey. AI workloads push that far higher, and once you reach the 30 kW per rack range and beyond, conventional air cooling starts running out of breath. Direct-to-chip and immersion cooling enter the conversation, with a per-rack cost premium that isn't small.

IT infrastructure

Servers, storage, switches, routers, structured cabling. In a colocation facility this belongs to the tenant. For an enterprise building its own, it often becomes the largest share of total spend, exceeding the facility cost itself.

One item that regularly slips past the budgeting stage: the refresh cycle. IT equipment is generally modeled on a 5 year life while the facility is designed for well over a decade. So you will be spending heavily again long before the building shows its age.

Security systems

Here's where the budgeting anomaly happens.

Physical security rarely gets its own CapEx category. It rides inside other line items, sometimes split across several contractor packages. The scope is wide, though: access control and its controllers, card readers and biometrics, CCTV with VMS and storage, perimeter intrusion sensors, mantraps or interlocking doors, visitor management, electronic cabinet locks, and the command center where all of it gets watched.

Because it has no line of its own, security is often first on the chopping block when the project comes under cost pressure. The consequence lands two years later, when the first customer audit arrives and asks for the per-rack audit trail that was never installed.

We deliberately left SECOM system pricing out of this article, and not because it's being hidden. Security configuration can't be quoted from a catalog. Number of access points, perimeter length, number of data halls, guard post operating hours, and target rated level all change the design fundamentally. An honest figure only comes out after a site survey.

Certification and commissioning

TIA-942 or Uptime Institute audits, SNI 8799 certification, ISO 27001, and integrated systems testing before go-live. Small in nominal terms, large in risk terms. Failures during integrated systems testing, which usually trace back to poor MEP coordination at the design stage, have been reported to push projects back by an average of nearly four months.

OpEx components

Electricity and PUE

Electricity is the largest bill the facility will ever carry. A 100 MW site running at full load consumes roughly 876 million kWh a year, before you multiply by tariff.

Efficiency gets measured with Power Usage Effectiveness. The Uptime Institute 2025 survey put the weighted global average PUE at 1.54, essentially unmoved for six consecutive years. Google reported a fleet-wide PUE of 1.09 for 2025. That gap isn't about secret technology. It's about climate, facility age, and scale.

For Indonesian operators, a PUE of 1.5 already counts as a good result. The tropics hand you a structural disadvantage that facilities in Scandinavia never face.

Maintenance

Thunder Said Energy's estimate places maintenance as the largest OpEx share at around 40%, with electricity somewhere between 15% and 25%. Generator service contracts, UPS battery replacement, chiller servicing, sensor calibration, filter changes. All scheduled, all recurring.

Manned guarding and monitoring

Technology detects. People decide and respond.

This line covers certified security officers, supervisors, command center operators, and the response team. For facilities targeting a higher rated level, 24 hour on-site presence isn't an operational preference. It's part of the design requirement.

Worth noting how the roles split inside the SECOM group: the guarding side is handled by SECOM Bhayangkara, while SECOM Indonesia handles the systems side, covering alarms, access control, CCTV, and centralized monitoring. Two entities, one chain of responsibility.

Licensing and compliance audits

The line most often missing from a first-year financial model. VMS and access control licenses are usually priced per camera or per door, and they grow every time the facility expands. Add annual surveillance audits for ISO 27001 and SNI 8799, TIA-942 recertification, plus audits from enterprise customers who bring their own standards.

A colocation facility with dozens of corporate tenants can field physical audit requests several times a year. Each one consumes operations team hours.

Why rated level drives your security budget

This is where the two halves of this article meet.

ANSI/TIA-942, whose current edition TIA-942-C was published in May 2024, sorts data centers into four Rated levels. Rated 1 has single components with no redundancy. Rated 2 adds redundant components. Rated 3 is concurrently maintainable, meaning any component can be serviced without taking the service down. Rated 4 is fault tolerant, with fully independent dual paths.

The part that gets misread: Rated level isn't only about power and cooling. The standard assesses four categories at once, and architecture along with physical security sits among them. Moving up a Rated level raises the requirements for security zoning, access control, and path separation.

Public summaries of the standard describe the escalation roughly like this. At Rated 2, two-factor access control starts being recommended. At Rated 3, separate security zones appear as a requirement, along with a mantrap as the entry path into the server hall and 24 hour on-site security presence. Rated 4 raises it again. The full normative text is only available by purchasing the official standard from TIA, so verification of any specific clause should happen with a licensed auditor rather than from any summary, this article included.

The budget consequence is measurable. Several construction analyses put the step from Tier II to Tier III at 15% to 25%, and Tier IV at 25% to 40% above Tier III. Part of that increase is purely electrical and mechanical. Part of it is architectural and security.

So if you're targeting Rated 3 or Rated 4, physical security is not an add-on you can defer to phase two. It's a design consequence. A mantrap needs floor area allocated on the plan from the start. Layered security zones need a circulation flow drawn into the architectural drawings, not patched in after the walls are up. Conduit for access control and CCTV cabling has to enter MEP coordination alongside the pipes and ducting.

Retrofit always costs more. Sometimes it isn't just expensive, it's impossible without demolition.

Data center security: four layers of defense

The principle is old and simple in physical security work. Any single layer can be beaten, so a high-value asset needs several independent layers of control. Each layer has a different job. Deter, detect, delay, then respond.

There's a piece of arithmetic behind it that tends to disappear once the conversation moves to product specifications. The total delay your layers provide has to exceed the time your response team needs to reach the incident. If your fence and doors together hold an intruder for three minutes while the nearest officer needs eight, no quantity of hardware saves the situation. Early detection at the outer layer stretches the left side of that equation. Guard post placement shortens the right side.

For a data center, these four layers are the framework we use when designing a system.

Layer 1: Perimeter

The perimeter's job isn't to stop an intruder. Its job is to force anyone who wants in through a single point you control, and to tell you early if someone is trying another route.

It starts with the fence and the standoff distance between fence and building wall. That standoff does two things: it buys response time, and it keeps vehicles away from the structure. Bollards or anti-ram barriers at the vehicle entrance handle the second function.

Perimeter intrusion detection can be fence-mounted sensors, buried sensor cable, or microwave barriers across open ground. The technology choice depends heavily on site conditions.

Then CCTV with video analytics. Cameras without analytics along hundreds of meters of perimeter are close to useless, because no operator can watch twenty screens all night. Analytics turn a camera from a recording device into a detection device: line crossing, loitering detection, abandoned object detection, human versus vehicle classification.

There's a local problem here that rarely appears in vendor brochures. Heavy rain, fog, insects drawn to infrared illuminators, cats, palm fronds swaying in the wind. All of it triggers false alarms. A perimeter system calibrated for a temperate climate will flood the command center with notifications in the first week of the rainy season. After that, operators stop believing the alarms, and that's far more dangerous than having no system at all. Tropical calibration isn't a minor technical detail, and it belongs in the commissioning test scope.

Lighting gets treated as a building aesthetics question when it's actually a detection component. Even the best camera sensor needs even light across the field of view. A dark patch between two lamp poles is a hole in your coverage, and that hole doesn't show up on the design drawing. It shows up during a night walk test. Crime Prevention Through Environmental Design applies here too: cut back vegetation that creates hiding places, eliminate blind corners along the building face, and route pedestrian paths through areas visible from the guard post.

Vehicle screening comes in levels, and the choice follows the facility's risk profile. The basic version verifies driver identity and matches it against the delivery schedule. The next level adds vehicle compartment inspection and under-vehicle mirrors. Facilities with government or financial sector tenants sometimes ask for a separate holding area where vehicles wait for verification before the second gate opens.

The guard post closes this layer. Not just a place to sit, but a control point: driver identity verification, inspection of vehicles entering the loading area, logging, and communication back to the command center.

What ultimately determines the quality of the first layer is what happens after the alarm sounds. A sensor that fires with no clear response procedure produces nothing but a record. What needs designing alongside the hardware: who receives the notification, how many seconds they have to confirm it on camera, when they dispatch a patrol, and when they escalate outside the site. This procedure belongs in the design documents, not in a scramble after the system is installed.

Layer 2: Building and lobby

Once someone is inside the building, the question changes. No longer "who is outside", but "is this person authorized to be here, and where are they headed".

Access control at the building entrance should already be two-factor, card and PIN at minimum. Cards get lent, lost, and cloned. The second factor breaks that chain.

A mantrap, sometimes called an airlock or access control vestibule, is a small space with two interlocking doors. The first door has to close fully before the second can open. The effect: one person passes at a time, and anyone who fails verification is held in the space between. Stricter versions use weight sensors or time-of-flight sensors to confirm only one person is inside.

Visitor management is often the weakest point, because at many facilities the process is still a paper logbook and a generic visitor badge. A tighter approach: pre-registration before arrival, identity verification against a scanned official document, badges with an expiry that kills them automatically, mandatory escort policy across all technical areas, and automatic logging that can be pulled during an audit.

Screening belongs at this point too. X-ray baggage scanners and walk-through metal detectors are common at facilities with financial or government tenants. If you're considering an X-ray scanner, its placement has to follow the building's pedestrian traffic pattern, and the operator needs a radiation source utilization license from BAPETEN. That part gets skipped often when a vendor offers a unit without discussing permits.

One area almost everyone overlooks: the loading dock. Goods come in, vendor technicians come in, contractors come in, usually through a door with far looser control than the main lobby. Design the loading dock as its own zone with its own controls, not as a back entrance.

There's a design tension to resolve at this layer, and resolving it on paper is much cheaper than resolving it on site. Fire safety regulations require escape routes to open freely from the inside, while security logic wants every door locked and logged. The answer isn't picking one. Emergency doors stay freely openable from within, but carry a local alarm and door status monitoring, so every opening is recorded and triggers camera verification. Facilities that try to work around this by chaining the emergency exits will fail their safety inspection, and they deserve to.

Mechanical keys need their own governance. Every data center has physical keys for panels, generator rooms, UPS rooms, and technical areas that never make it into the electronic system. Without proper key management, meaning a controlled key cabinet, issue logging, and periodic audits, you have an expensive access control system at the front door and a spare key sitting in a reception desk drawer.

Contractors and vendor technicians deserve different handling from ordinary visitors. They come repeatedly, they carry equipment, and they work in technical areas. The safer practice: an approved vendor personnel list agreed in advance, temporary credentials that expire automatically at the end of the work period, bag checks on exit for certain areas, and access revocation triggered automatically when the contract ends. That last point leaks the most. Plenty of facilities are diligent about issuing access and forget to take it back.

Layer 3: Data hall and white space

Highest consequence area, smallest authorized population.

Authentication at the data hall door should be multi-factor with biometrics as one of the factors. Palm vein, iris, or fingerprint, depending on environmental conditions and operational preference. Palm vein has a practical advantage in technical environments because skin surface condition doesn't affect it and it needs no direct contact.

Anti-tailgating becomes mandatory at this layer. Tailgating, following an authorized person through a door without presenting your own credential, is the simplest way to defeat even the most expensive access control system. Solutions range from full-height turnstiles to interlocking portals with occupancy sensors, or overhead tailgate detection sensors that raise an alarm when two people pass on one credential.

Logging is why this layer exists from the compliance side. Every door event is recorded: who, when, which door, in or out. Anti-passback ensures a credential already used to enter can't be used to enter again before it has been recorded leaving. This is the log that gets pulled when an ISO 27001 auditor or a banking sector tenant asks for evidence of physical access control.

For multi-tenant colocation, physical separation between tenants through cages or locked rooms is standard. Tenant A must have no physical route to Tenant B's equipment, and that has to be demonstrable, not merely promised in the contract.

Camera coverage inside the data hall needs to be designed per aisle, not per room. A corner camera capturing a general view won't help when you have to answer who opened cabinet 14 at two in the morning.

On recording retention, set the number from your compliance obligations and tenant requirements, then calculate storage before you fix the camera count. That order matters and it's frequently reversed. Resolution, frame rate, camera count, and retention period are all bound together in one capacity equation. Raising one without recalculating the others produces a system that overwrites old footage faster than you expect, and you usually find out at the moment you need that footage.

For the highest consequence zones, some operators apply a two-person rule: nobody may be alone inside a given area, and the door only opens when two different credentials are verified in sequence. This control is operationally expensive because it ties up two people for one task, so it's usually limited to genuinely sensitive rooms rather than the whole data hall.

Escort policy needs a number attached, not just a statement. How many people can one escort accompany? One escort to ten visitors is, in practice, no escort at all. A workable ratio for technical areas usually sits between one to two and one to four, depending on room layout and sight lines.

Device policy belongs to this layer as well. Camera and phone bans inside the data hall are common at facilities with financial sector tenants, though enforcement demands discipline and lockers at the entry point. Just as important, storage media leaving the facility needs its own procedure, from logging through to evidence of wiping or destruction.

Layer 4: Rack and cabinet

The last layer, and the one skipped entirely most often.

The logic runs like this. The three preceding layers verify that a person is authorized to enter a room. Not one of them verifies that the person is authorized to touch a specific rack inside that room. A vendor technician arriving to swap a disk in cabinet 7 has exactly the same physical access to cabinets 8 through 30, unless there's a control at cabinet level.

Electronic cabinet locks close that gap. Handles with a card reader or biometric sensor, tied into the same access control system, with permissions granted per cabinet and restricted by time window. There are also controlled mechanical key variants for facilities not yet ready for a fully electronic system.

Per-access audit trail is the real value of this layer. Every cabinet opening is recorded with identity and timestamp, then reconciled against the work ticket. If equipment goes missing or a configuration changes without explanation, you have a short list of names instead of a list of everyone who entered the building that day.

Tamper sensors on cabinet doors complete the electronic lock. The lock records authorized openings. The sensor records unauthorized ones, including attempts to open by other means. You need both, because what you're looking for during an investigation is the anomaly, not the normal activity.

Integration with the ticketing system turns the log into a control that actually functions. A standalone cabinet access log is only useful if somebody reads it. Once that log reconciles automatically against work tickets, any opening without a matching ticket stands out immediately. That's work no one can do manually across a facility with hundreds of cabinets.

One physical detail that slips through: cabinets with front and rear doors locked properly, but side panels that come off without special tools. Or two adjacent cabinets with no divider, so a hand can reach from one into the other around the back. Serious rack-level control checks the integrity of the whole enclosure, not just the doors.

For colocation operators, cabinet-level control has shifted from a technical feature into a commercial argument. Banking and insurance tenants increasingly write it into tender requirements rather than treating it as a nice extra. Adding it after the racks are installed and populated is far more disruptive than preparing for it from the start.

If one layer goes missing from the budget most often and costs the most to add later, this is the one.

Standards and regulations to meet in Indonesia

Data center compliance in Indonesia rests on several layers of rules, each with a different character.

PP 71/2019 on the Operation of Electronic Systems and Transactions requires Electronic System Operators to run their systems reliably and securely, with risk management covering the damage or loss that might arise. Public-scope operators must keep data and processing inside Indonesian territory. Private-scope operators may still place data offshore, provided they guarantee audit access and equivalent protection.

Law Number 27 of 2022 on Personal Data Protection, enacted on 17 October 2022, obliges Personal Data Controllers and Processors to protect data through technical and organizational controls. Sanctions escalate from administrative to criminal. Physical access control to storage facilities falls within the scope of that obligation.

SNI 8799 Information Technology Data Centers, first issued in 2019 by Technical Committee 35-01 with Parts 1 and 2 revised in 2023, sets out the strata 1 through 4 classification and its technical requirements. Physical security, covering access supervision and surveillance systems, is named as one of its main components.

ANSI/TIA-942 and the Uptime Institute scheme are the international standards used widely across the Indonesian colocation market. Certification frequently becomes an entry requirement in enterprise tenders.

ISO/IEC 27001 for information security management and ISO 22301 for business continuity round out the governance side. Physical and environmental security controls are an explicit part of ISO 27001 Annex A.

One more layer, specific to Indonesia and regularly missing from foreign consultants' checklists: Perpol Number 4 of 2020 on Pengamanan Swakarsa, with some provisions updated through Perpol Number 1 of 2023. The rule requires security service providers to be incorporated as a Perseroan Terbatas holding a Surat Izin Operasional (SIO) from Polri, and every active security officer to hold a Kartu Tanda Anggota (KTA) plus a minimum Gada Pratama training qualification.

In practice: if your manned guarding vendor can't show a valid SIO and the KTA of the officers assigned to your site, your facility's compliance has a hole at the easiest point for an auditor to check.

Next steps

If you're putting together a data center business case, use the figures in this article for early calibration, then hand the real costing to the MEP consultant or EPC contractor who will run the feasibility study. That's their territory, and they're better at it than anyone selling security systems.

The security layer works differently. There's no standard price we can email you, because no two facilities share the same perimeter, circulation flow, and risk profile. What we do first is a site survey: mapping access points, calculating coverage requirements, assessing the environmental conditions that will affect sensor calibration, and matching the design to your target rated level. The recommendation and the numbers come out of that.

If your project is still at the drawing stage, now is the best time to talk. Security layers designed alongside the architecture always end up cleaner, cheaper, and more audit-resistant than the ones added after the walls go up.