Server cabinet door sensor: monitoring physical access to racks under ISO 27001:2022
A magnetic door contact on a rack or server room door, wired to a network logger, gives you a time-stamped record of every opening and an alarm when a door opens outside a maintenance window. That is the cheapest way to show evidence for ISO 27001:2022 control 7.4, physical security monitoring, which was added in the 2022 revision and asks that premises be continuously monitored for unauthorised physical access.
In short
- ISO 27001:2022 control 7.4 is new: premises must be continuously monitored for unauthorised physical access, with intruder detection, alarms or CCTV. A lock alone is no longer evidence.
- A magnetic contact costs about EUR 10, needs no power, and connects to a dry-contact input on the same logger that measures rack temperature.
- The logger records every opening with a timestamp, sends e-mail on an opening outside working hours, and exposes the state over SNMP to Zabbix or PRTG.
- For a co-located or shared rack, a door contact on the cabinet is the control the auditor asks about; the room door belongs to the landlord.
What ISO 27001:2022 asks for
The 2022 revision of ISO 27001 reorganised Annex A into four themes and added eleven new controls. One of them is 7.4, physical security monitoring: premises should be continuously monitored for unauthorised physical access. Guidance in ISO 27002:2022 names the tools, intruder alarms, contact detectors on doors and windows, CCTV and access control logs, and stresses that the monitoring should detect access in real time, not only record it for later.
Control 7.4 sits alongside 7.1 (physical security perimeters), 7.2 (physical entry) and 7.3 (securing offices, rooms and facilities). Together they mean a server room needs a defined perimeter, controlled entry, and now a way of knowing that entry happened. For most small and medium organisations the CCTV and the access-card system cover the building; the gap is the rack itself, inside a room that cleaners, contractors and the landlord's electrician also enter.
How a door contact works and where to mount it
A magnetic contact is two parts: a reed switch in one housing and a magnet in the other. The switch is fixed to the frame, the magnet to the door, with a gap of no more than 15 mm when closed (5–10 mm is recommended). While the magnet is near, the contact is closed; open the door and the contact opens. The sensor needs no power of its own, and the two-core cable runs to a dry-contact input on the logger; standard cable is 2 m and can be extended to 50 m.
- Rack front door: switch on the frame at the top hinge side, magnet on the door. Top mounting keeps it clear of cable trays.
- Rack rear door or side panels: a second contact if the rear is accessible; side panels are usually screwed and can be ignored.
- Server room door: switch on the frame, magnet on the leaf, on the inside where it cannot be tampered with from the corridor.
- Two doors, one input: wire two contacts in series. The input opens if either door opens. You lose the "which one" but keep the alarm on a single input.
The KMS-30 is a contact of this type, designed for EnviSensor inputs and compatible with the dry-contact input of most alarm panels as well.
One logger for door, temperature and leak
The reason to put the door contact on the environmental logger rather than on a separate alarm panel is that the logger is already there, already on the LAN, and already reporting to your monitoring. An EnviSensor ETH PoE takes up to four inputs: a temperature probe at the top inlet, a second at the UPS, a leak sensor on the floor and the door contact. One patch cable, one IP address, one line in Zabbix.
The logger timestamps every change of state, keeps the history, and sends an e-mail on opening. The state is also readable over SNMP and on the JSON page, so the monitoring platform can raise a ticket on "rack door open" exactly as it does on "temperature high". A cloud app adds push notification to a phone, which is what you want at 23:00 on a Saturday.
Turning openings into audit evidence
An auditor for control 7.4 wants to see that monitoring exists, that it produces alerts, and that alerts are acted upon. Three artefacts satisfy that:
- The opening log. An export of door events for the audit period, showing date and time of each opening and closing. Cross-check a sample against the change calendar: every opening should match a ticket or a maintenance window.
- The alarm rule. A screenshot or configuration export showing that an opening outside defined hours, or of longer than a set duration, sends an alert to a named group.
- The response record. For at least one alarm, the ticket or note showing who received it, when, and what they did, even if the answer was "contractor on site, confirmed by phone".
Two settings make the log more useful. Alarm on duration as well as opening: a rack door left open for 30 minutes is a cooling problem and a security one. And alarm on opening without a ticket if your monitoring platform can correlate with the change system; if not, the out-of-hours rule catches most of what matters.
Shared rooms and colocation
In a colocation facility or a shared building the room door is not yours. The provider's access logs are their evidence, not yours, and an auditor will ask what you control. The answer is the cabinet. A door contact on your own rack, wired to your own logger, gives you an independent record of physical access to your equipment that does not depend on the provider's system or on their willingness to export logs.
The same applies to a branch office where the rack stands in a storeroom with a shared key. A EUR 10 contact and a logger you already need for temperature turn a room you cannot control into a cabinet you can.
Frequently asked questions
Does ISO 27001 require a door sensor on a server rack?
Not by name. Control 7.4 of ISO 27001:2022 requires continuous monitoring for unauthorised physical access; a door contact with logging and alarms is one of the simplest ways to evidence that for a rack or server room.
How does a magnetic door contact work?
A reed switch on the frame and a magnet on the door. While the door is closed the magnet holds the switch closed; opening the door opens the contact, and the logger records the change. The sensor needs no power.
Can a door sensor share a logger with temperature sensors?
Yes. Loggers with dry-contact inputs, such as EnviSensor ETH PoE with four inputs, take a door contact alongside temperature and leak sensors, so one device covers a whole rack.
What evidence does an auditor want for physical security monitoring?
A log of door events for the period, the alarm rule showing who is alerted on out-of-hours openings, and at least one example of an alarm being received and acted on.
How far can the door contact be from the logger?
The standard cable is 2 m and can be extended to about 50 m, enough to reach a room door from a logger inside the rack.
Related pages
KMS-30
Magnetic door contact for EnviSensor inputs, EUR 10 net.
EnviSensor ETH PoE
Four inputs: temperature, door, leak, smoke.
Early smoke detection
The other input worth using in a rack.
Need monitoring at your site?
We will help you choose sensors and the way they run — locally on your LAN, in your own monitoring system or in the CE MonitorApp cloud.
