Tailgating is the act of following an authorized person through a secured entry point without presenting valid credentials. In a data center environment, it is one of the most persistent physical security risks: a single unauthorized entry to a server hall bypasses endpoint security, firewalls, and identity management controls entirely. No physical control eliminates tailgating, but the right combination of hardware, access architecture, and system integration reduces exposure to a level that satisfies most compliance frameworks.
This guide covers the physical and procedural controls available for data center physical security environments, from colocation facilities to enterprise and hyperscale sites.
Key takeaways
- Tailgating is one of the most persistent physical security risks in data center environments.
- Standard card reader installations authenticate credentials, not people.
- The most effective controls are mantraps and interlocks, multi-factor authentication, video analytics, and zone segmentation, applied in combination across zone boundaries.
What is tailgating and why is it a risk in data centers?
Tailgating is following an authorized person through a secured door without their knowledge. Piggybacking is the same act performed with the authorized person's awareness, often the result of politeness overriding security protocol. Both result in an individual inside a restricted zone with no access record.
The risk in data center environments is that physical access supersedes all logical security controls. An unauthorized individual inside a server hall can extract drives, install hardware keyloggers, or disrupt power and cooling without requiring network credentials.
The compliance implications are direct. ISO 27001 Annex A.7, SOC 2 (Availability and Confidentiality criteria), and PCI DSS Requirement 9 all mandate documented physical access controls. A tailgating event that results in data exposure can constitute a breach of these obligations regardless of whether logical security systems were untouched.
What physical controls reduce tailgating risk in data centers?
No single control is sufficient. The goal is to require an unauthorized entrant to defeat multiple independent layers, each of which also generates a detection or alert signal. Gallagher designs its access control solutions around this layered architecture.
Mantraps and interlocks
A mantrap (also called an airlock or security vestibule) is a two-door entry system where the first door must fully close and the entry be authenticated before the second door opens. Interlocks apply the same logic to higher-security zones and can incorporate weight or occupancy sensors for additional assurance.
Multi-factor access controls
A card reader authenticates a credential, not a person. Multi-factor physical authentication (card plus PIN, card plus biometric) increases both the cost and the visibility of a tailgating attempt, because the second factor requires active participation from a specific individual.
Gallagher's reader range supports multi-factor configurations including biometric integration, enabling tiered authentication across zone boundaries within a single Command Centre managed platform.
Video analytics and real-time detection
AI-powered video analytics can detect tailgating in real time by counting bodies passing through an entry point and triggering an alert or door lockout when the count exceeds one per credential read. Detection is most effective when analytics are integrated with the access control management system so alerts are automatically correlated with access events rather than managed in a separate platform. Gallagher's Command Centre supports this integration model.
Visitor and contractor management
Contractors and visitors are the highest-risk group for tailgating. They carry temporary credentials, are less familiar with site protocols, and are often legitimately escorted, which creates scenarios difficult to distinguish from authorized accompanying access. Three system-enforced controls address this group:
- Time-limited credentials that expire automatically at the end of an access window.
- Escort enforcement as a system rule: the visitor credential is only valid when paired with an active, credentialed escort.
- Visitor management integration with access control so every visitor movement is logged against a visit record. Through a secure integration with Command Centre, visitor management supports pre-registration, badge issuance, and automatic access removal on departure.
How should data center security zones be structured to limit tailgating exposure?
Zone segmentation divides the facility into concentric rings of increasing access restriction such as perimeter, building entry, operations floor, server hall, and high-security cage or cabinet. Tailgating risk reduction controls are applied at each zone boundary, not uniformly across the facility. This limits the consequence of a successful tailgating event.
This architecture maps directly to ISO 27001 Annex A.7 and is a common audit requirement under SOC 2 and PCI DSS. Gallagher builds its data center security solutions around this layered zone model, with Command Centre providing centralized access management and a full audit trail across all zones. For a structured review of your current system configuration, Gallagher's Security Health Check provides automated vulnerability identification and a prioritized remediation report.
Frequently asked questions
What is the difference between tailgating and piggybacking?
Tailgating is following an authorized person through a secured entry point without their knowledge. Piggybacking is the same act performed with the authorized person's awareness, often the result of a colleague holding a door open.
Can tailgating be eliminated?
No. No physical control eliminates tailgating entirely. The combination of mantrap and interlock hardware, multi-factor authentication, video analytics, and zone segmentation reduces risk to a level that satisfies most compliance frameworks, but residual risk remains.
Does tailgating prevention affect data center compliance?
Yes. ISO 27001, SOC 2, and PCI DSS all include specific physical access control requirements that tailgating risk reduction directly addresses.
How does Gallagher's platform support tailgating risk reduction?
Gallagher's Command Centre provides a unified platform for managing access control, intruder alarms, perimeter security, visitor management, and video integration across all zone boundaries. Anti-passback rules, time-limited credentials, and escort enforcement are all configurable within a single management interface. For data center-specific deployment guidance, see Gallagher's data center security page or speak with a Certified Channel Partner.