Scope & checklists · updated August 2026
How to Make Your Server Room Genuinely Off-Limits to Cleaners
Saying it is not enough — take the room off the master key and issue no credential for it. The mechanism is a restricted areas exhibit attached to the cleaning agreement, listing rooms by number with an access rule, plus physical controls: separate keying or badge group, the room removed from any master, a door contact sensor and a written rule that no cleaning vendor ever holds a server room key.
The Restricted Areas Exhibit
A one-page attachment that turns a policy into a contract term. Structure it like this:
| Room | Access rule | Credential held by | Escalation contact |
|---|---|---|---|
| Server room — Rm 412 | No entry | IT only | Named person, mobile |
| IDF closet — Rm 308 | No entry | IT only | Named person, mobile |
| Records room — Rm 210 | Escorted only | Facilities | Named person, mobile |
| Executive suite | Scheduled only, Tue & Thu | Cleaning supervisor | Named person, mobile |
The Zone Model on a Floor Plan
- Green — full clean. Open floor, kitchen, meeting rooms, restrooms, corridors.
- Yellow — clean with restrictions. Desks with equipment, AV rooms, printer areas.
- Red — no entry. Server room, IDF and MDF closets, security room, secure storage.
Mark it on an actual floor plan and attach it. A written list is good; a marked plan is unambiguous, including for a substitute crew member on their first night.
Physical Controls Checklist
- Separate keying or badge group for the IDF and MDF closets
- Room removed from the master key — this is the step most offices skip
- Door contact sensor and camera coverage
- A clear sign on the door: Do not enter — cleaning staff. In New York, worth posting in English and Spanish.
- Waste handling defined: either IT empties the room's own bin, or an escorted collection on a schedule
- Written rule: no cleaning vendor receives a key or credential to a server room, ever
The SOC 2 Evidence
Common Criteria CC6.4 requires restricting physical access to facilities and protected assets. Four documents satisfy the janitorial part of it: the restricted areas exhibit, the current named access list, the escort or entry log, and vendor NDAs with a background-check attestation. Related frameworks: ISO 27001 Annex A physical and environmental security, PCI DSS Requirement 9 where card data is in scope, and NIST SP 800-53 PE-2 and PE-3.
Off-Limits Does Not Mean Never Cleaned
This is the nuance most policies miss. Raised-floor plenums accumulate dust that ends up in intake fans and should be cleaned by a specialist, typically annually and escorted. Rack exteriors are handled by IT or an escorted specialist. General janitorial staff should be nowhere near either — but the room still needs a maintenance plan, and writing “no entry” without one means it is simply never cleaned until something fails.
Last reviewed August 2026. Figures for prevailing wage and regulatory schedules change on 1 January and 1 July — we re-verify this page each cycle.
Want This Answered for Your Actual Space?
We publish the general answer because it is useful. For a number that applies to your building, send us the square footage and the nights you need.
Get a Price for Your Space
Written scope and fixed monthly price, usually within two business days.
We reply to every request. If your building needs a Certificate of Insurance or vendor registration, we handle that paperwork before the first night.
Ready for a Cleaning Contract You Can Actually Read?
Send us your square footage and how many nights you need. You get a written scope, a fixed monthly price, and the SLA in the same document — usually within two business days.