Scope & checklists · updated August 2026
How to Make Your Server Room Genuinely Off-Limits to Cleaners
Saying it is not enough — take the room off the master key and issue no credential for it. The mechanism is a restricted areas exhibit attached to the cleaning agreement, listing rooms by number with an access rule, plus physical controls: separate keying or badge group, the room removed from any master, a door contact sensor and a written rule that no cleaning vendor ever holds a server room key.
The Restricted Areas Exhibit
A one-page attachment that turns a policy into a term you can enforce. Structure it like this:
| Room | Access rule | Credential held by | Escalation contact |
|---|---|---|---|
| Server room — Rm 412 | No entry | IT only | Named person, mobile |
| IDF closet — Rm 308 | No entry | IT only | Named person, mobile |
| Records room — Rm 210 | Escorted only | Facilities | Named person, mobile |
| Executive suite | Scheduled only, Tue & Thu | Cleaning supervisor | Named person, mobile |
The Zone Model on a Floor Plan
- Green — full clean. Open floor, kitchen, meeting rooms, restrooms, corridors.
- Yellow — clean with restrictions. Desks with equipment, AV rooms, printer areas.
- Red — no entry. Server room, IDF and MDF closets, security room, secure storage.
Mark it on an actual floor plan and attach it. A written list is good; a marked plan is unambiguous, including for a substitute crew member on their first night.
Physical Controls Checklist
- Separate keying or badge group for the IDF and MDF closets
- Room removed from the master key — this is the step most offices skip
- Door contact sensor and camera coverage
- A clear sign on the door: Do not enter — cleaning staff. In New York, worth posting in English and Spanish.
- Waste handling defined: either IT empties the room's own bin, or an escorted collection on a schedule
- Written rule: no cleaning vendor receives a key or credential to a server room, ever
The SOC 2 Evidence
Common Criteria CC6.4 requires restricting physical access to facilities and protected assets. Four documents satisfy the janitorial part of it: the restricted areas exhibit, the current named access list, the escort or entry log, and vendor NDAs with a background-check attestation. Related frameworks: ISO 27001 Annex A physical and environmental security, PCI DSS Requirement 9 where card data is in scope, and NIST SP 800-53 PE-2 and PE-3.
Off-Limits Does Not Mean Never Cleaned
This is the nuance most policies miss. Raised-floor plenums accumulate dust that ends up in intake fans and should be cleaned by a specialist, typically annually and escorted. Rack exteriors are handled by IT or an escorted specialist. General janitorial staff should be nowhere near either — but the room still needs a maintenance plan, and writing “no entry” without one means it is simply never cleaned until something fails.
Last reviewed August 2026. Figures for prevailing wage and regulatory schedules change on 1 January and 1 July — we re-verify this page each cycle.
Want This Answered for Your Actual Space?
We publish the general answer because it is useful. For a number that applies to your building, send us the square footage and the nights you need.
Get a Price for Your Space
Written scope and fixed monthly price, usually within two business days.
We reply to every request. If your building needs a Certificate of Insurance or vendor registration, we handle that paperwork before the first night.
Ready for Office Cleaning You Can Actually Check?
Send us your square footage and how many nights you need. You get a written scope, a fixed monthly price, and the SLA in the same document — usually within two business days.