Part of Infrastructure hosting standards for the NHS
Environmental and physical protection
Standards you should meet on environmental and physical protection.
1. NHS organisations should ensure hosting environments provide adequate physical security
Importance of meeting the standard
Physical security prevents unauthorised access to hosting environments, reducing the risk of tampering, theft, service disruption and data compromise. Hosting areas often support systems essential for clinical care, so protecting them is a key element of digital and operational resilience.
When to meet the standard
- creating, refurbishing or relocating server or hosting rooms
- deploying new hosting infrastructure in unsecured or multi‑purpose spaces
- reviewing security following incidents, audits or organisational change
- introducing new systems that increase reliance on hosted services
How to meet the standard
- access to hosting environments is controlled, monitored and restricted to authorised personnel
- hosting spaces are secured using appropriate methods (for example keycard access, mechanical locks, access logs)
- access permissions are reviewed regularly and updated when roles change
- visitor or contractor access is supervised or time‑limited
- hosting environments form part of wider organisational security policies
- physical access controls should enforce least‑privilege principles
- access logging should be enabled where feasible and reviewed periodically
- doors, cabinets and secure enclosures should be lockable and maintained in good working order
- hosting areas should be protected from public or high‑traffic zones
2. NHS organisations should ensure hosting environments include appropriate fire detection and suppression controls
Importance of meeting the standard
Fire or smoke events pose an immediate risk to staff safety, critical digital services and physical infrastructure. Appropriate fire controls reduce the likelihood of damage and support safer recovery following incidents.
When to meet the standard
- designing or constructing new hosting rooms
- upgrading estate infrastructure or fire systems
- installing high‑density or heat‑generating equipment
- responding to fire safety risk assessments
How to meet the standard
- hosting spaces include appropriate fire detection (for example smoke or heat detection)
- fire suppression measures are selected based on room size, occupancy and risk profile
- electrical installations meet fire safety requirements
- fire plans include hosting environments and are reviewed regularly
- escape routes and emergency shutdown procedures are understood by staff
- use approved fire detection equipment suitable for IT environments
- where suppression is required, use solutions appropriate for electronic equipment (for example inert gas, water‑mist)
- ensure alarm integration with building‑wide systems
- document all fire safety controls and validation processes
Last edited: 18 June 2026 12:33 pm