Zero trust should be part of a data center handover, not a later software project

Image: AI-generated editorial illustration, not a photograph of a specific project.

INFRADAY ANALYSIS

A completed data center comes with more than keys and equipment manuals. It also comes with accounts, remote connections, administrative privileges and decisions about who can reach which systems.

Those arrangements deserve an explicit place in turnover. Otherwise, the operator can inherit a working facility without a sufficiently clear account of its digital access boundaries.

NIST’s guidance on implementing zero trust, finalized in 2025, offers 19 example architectures developed using commercial technologies with 24 industry collaborators. The agency presents them as implementation starting points for organizations with different environments, rather than a single configuration everyone should install.

The central principle is that access should not be trusted merely because of network location. Applying that principle requires understanding the users, devices and resources involved.

Turn the principle into a scope of work

Infraday’s recommendation is to ask each delivery team for an access inventory before handover. Which vendors retain remote access? Which accounts are temporary? Who approves a new connection, and who removes access when a contract ends?

The owner should assign responsibility for reviewing those answers. A construction contractor, IT team and facilities operator may each hold part of the picture. A named owner needs to bring the relevant records together.

This review should distinguish enterprise IT from operational equipment. NIST’s general examples are useful reference material, but they do not replace equipment-specific engineering, safety requirements or an assessment of how controls affect essential operations.

Ask for evidence an operator can use

An acceptance package could include approved access paths, account ownership, monitoring responsibilities and procedures for exceptional access. The owner should also understand how these arrangements will be maintained when suppliers or equipment change.

Testing should be scoped by qualified personnel to avoid disrupting critical systems. The objective is to demonstrate the agreed controls and recovery procedures, with records that remain useful after the construction team leaves.

Security requirements are easier to allocate when they are visible in procurement and commissioning. Leaving them to a later project can obscure who was meant to provide a control and whether its cost was included.

The practical value of zero trust is not the label attached to a facility. It is the operator’s ability to explain, verify and maintain who can access its resources throughout the asset’s life.

Sources: NIST, 19 example zero-trust implementations, June 2025.

Based on the public sources linked above, reviewed September 27, 2026. Project schedules and company commitments are attributed to their issuers; analysis and recommendations are Infraday’s.