What percentage of my data center budget should be allocated for physical security?
There is no standard formula for determining a data center's physical security budget allocation. Anticipated growth of your data center's physical security system during the time frame of your budget is a major determining factor. Additionally, strategies vary depending on whether you're budgeting for an existing data center's physical security or if it will be for a future project.
If you are attempting to estimate what you will require for a budget to maintain the installed components and systems in a data center where physical security has been installed, the integrator who is contracted to provide you with the service should be able to provide you with an exact service and maintenance number. However, I would recommend adding 20% to that number for any unforeseen, outside of contract maintenance costs.
For future project budgeting, you should be able to get a hold of what your facilities department has planned for projects that require physical security and estimate what the security costs related to those projects will represent. You will need to determine what the unique physical security requirements are for each project. Using 1% to 1.5% of a total project's construction costs should suffice.
The cost you incur as opposed to what is charged back to projects and other departments will generally fall into one of the four categories below:
Your department incurs the cost because the particular project is a project that originates from your security department (building a new security console).
A business unit incurs the cost because they are building out a new sensitive file room and require a card reader, camera and other similar devices. This cost will typically be incurred by the department requesting the room. The installation of security components is required and necessary due to the information contained in the room as a matter of Security/Audit Policy.
Base building incurs the cost because the installation of security components is designed to protect or control base building areas (main entryways, loading docks, inner lobby areas, etc.) Here the cost is absorbed as part of base building operations and is depreciated out over the remaining life of the building. The cost should not be directly absorbed by the security department.
The cost of security is part of an overall large construction project where the costs associated with security are absorbed and then depreciated as the facility ages. You may have a security budget relative to the project; however, the cost of physical security is not absorbed as a security department capital number.
ABOUT THE AUTHOR: Thor A. Mollung, CHSII, Managing Director, Security Consultant, has over 20 years of experience in the industrial security industry with companies such as Fidelity Investments, Mellon Bank and State Street Corporation. Mollung is a member in good standing of the American Society for Industrial Security (ASIS-International), the National Fire Protection Association International (NFPAI), and the American College of Forensic Examiners Institute.
This was first published in February 2007