Why data centre security is becoming identity-first

As New Zealand’s data centre sector grows, physical security is shifting from standalone access control toward a more unified, identity-led model

Data centres are becoming some of the most security-sensitive facilities in the modern economy. They support cloud services, banking, healthcare, government systems, AI workloads, and the digital infrastructure businesses increasingly depend on every day.

A recent Suprema article on identity-first security in data centres highlights a shift away from treating access control as a collection of standalone readers and credentials. Instead, operators are increasingly looking at every person, credential, and access event as part of a continuous identity record.

From Nextro’s perspective, that shift is particularly relevant as New Zealand’s own data centre footprint expands.

Why identity matters more in a data centre

Traditional access control answers a relatively simple question: does this credential have permission to open this door?

In a high-security environment such as a data centre, that is often no longer enough.

Operators need much greater confidence around who is entering, where they are permitted to go, when they accessed a particular area, and what other events occurred around that access.

Suprema describes this as an identity-first approach, where access events form part of a unified and traceable security record. In this model, technologies such as biometric authentication, multi-factor authentication, visitor management, and video-linked access events can work together rather than operating independently.

For a data centre, this can apply across multiple security layers, from the outer perimeter and loading areas through to plant rooms, technical spaces, data halls, cages, and ultimately the server rack.

The closer someone gets to critical infrastructure, the stronger the identity assurance can become.

Moving beyond the access card

Access cards remain useful, but a card primarily proves possession of a credential. It does not necessarily prove that the person presenting it is the authorised holder.

For higher-security areas, biometrics can provide another layer of assurance.

Suprema points to fingerprint and facial authentication, combined with multi-factor credentials, as increasingly important components of modern data centre security. Its BioStar X platform is designed to combine biometric access control, centralised monitoring, and integration with video surveillance to create a more complete record of physical access events.

From Nextro’s perspective, the important point is not that every door needs biometric authentication. Security should be proportional to the risk.

A reception entrance, contractor access point, technical plant room, and high-security data hall may all warrant different combinations of credentials, authentication factors, and monitoring.

Access control and video are stronger together

Identity-first security also becomes more valuable when access control is integrated with video surveillance.

An access event can tell an operator that a credential was used at a particular door. Video can provide the visual context around that event.

Together, the systems can help answer questions such as whether the correct person used the credential, whether another person entered at the same time, and what happened immediately before or after access was granted.

Suprema identifies this combination of identity, access records, and video as part of the move toward more traceable data centre security.

For Nextro, this reflects the wider direction of modern physical security design. Access control, video surveillance, intrusion detection, networking, and cybersecurity increasingly need to be considered as parts of the same security architecture rather than separate systems.

Why this matters in New Zealand

Why this matters in New Zealand

New Zealand’s data centre sector is expanding. DataCentres New Zealand reports that 56 data centres are currently operating nationally, with a further 20 facilities planned.

That growth is also visible in major cloud infrastructure investment. AWS opened its Asia Pacific (New Zealand) Region in September 2025 with three Availability Zones, enabling customers to run workloads and securely store data in New Zealand. AWS says its investment to establish the region is NZ$7.5 billion.

Invest New Zealand is also actively promoting data and digital infrastructure as an investment opportunity. It identifies New Zealand’s renewable electricity, resilient grid, available land, cool climate, digital connectivity, skilled workforce, and strong rule of law as advantages for future development. It also notes that more than 88% of New Zealand’s electricity comes from renewable sources.

As more critical data and computing infrastructure is located here, the consequences of a physical security failure become more significant.

The challenge is not simply preventing unauthorised entry through the front door. Operators need to understand and control movement throughout the facility while maintaining detailed, auditable records of access to sensitive areas.

Designing security in layers

For Nextro, an effective security architecture starts with understanding the different risk zones within a facility.

That may involve:

The aim is not to add complexity for its own sake. It is to apply stronger identity assurance as the sensitivity of the area increases.

What this means for New Zealand data centre operators

Suprema’s identity-first model reflects a broader shift in physical security.

For data centre operators, knowing that a door opened is no longer enough. Increasingly, organisations need confidence in who entered, why they had access, where they went, and whether the activity can be reconstructed later.

As New Zealand’s data centre sector continues to expand, these requirements will become increasingly important for new facilities and security upgrades.

Nextro designs integrated physical security and network solutions across New Zealand, including access control, biometrics, video surveillance, secure networking, and cybersecurity.

The strongest security outcomes will come from designing these technologies as a coordinated architecture, with identity at the centre, rather than adding individual security products one door at a time.

Contact Nextro today to discuss integrated access control, biometrics, video surveillance, and security architecture for critical infrastructure environments such as data centres .