Data Center Cleaning — IT Security Protocols 2026

Data center cleaning is a process requiring compliance with advanced IT security protocols, environmental parameter controls, and anti-static equipment. In a data center, a single procedural error during cleaning can lead to critical system failures or breaches of ISO 27001 compliance standards.

Modern data centers maintain temperatures of 18–27°C and relative humidity of 40–60%, which are fundamental operational requirements for server equipment. Every cleaning intervention must account for these parameters, as well as rigorous access protocols, prohibition of liquids in active zones, and certification of personnel working in critical facilities. In 2026, facility managers and IT administrators expect service providers to demonstrate not only technical knowledge but also documented compliance with information security standards.

Reefa has been delivering data center cleaning projects for Class A facilities in Cracow and Katowice since 2020, implementing pre- and post-intervention audit procedures and photographic reports documenting each activity in the server room.

In Brief

• Data center cleaning requires anti-static equipment (ESD), humidity control, and prohibition of liquids in active zones
• Access protocols include IT security certificates, authorized personnel lists, and entry/exit audit systems
• Intervention frequency depends on room classification: monthly for production data centers, quarterly for backup server rooms
• Scope includes vinyl and panel floors, cable trays, server cabinet surfaces, and HVAC ventilation
• ISO 27001 compliance requires documented procedures, personnel training, and reports from each intervention
• Rates start from PLN 150 net per hour for a two-person team with certified anti-static equipment

Why Is Data Center Cleaning Different From Standard Office Maintenance?

A server room is a critical facility where the priority is continuous operation of IT infrastructure. Unlike office cleaning, where conventional mops, detergents, and vacuum cleaners are used, in a data center every procedural element must account for the risk of electrostatic discharges (ESD), accumulation of conductive dust, and contaminants that could block equipment ventilation.

Dust settling on servers reduces cooling efficiency and can cause overheating of components. These facilities are characterized by specialized finishes—raised floors that allow cold air circulation, cable trays running under flooring or suspended ceilings, and hermetically sealed access control systems. In such conditions, standard wet cleaning methods are excluded—even a small amount of liquid reaching an active equipment zone could cause a short circuit.

The data center cleaning protocol covers several key areas:

1. Prohibition of water and detergents in active zones — only anti-static aerosol products or microfiber dry cloths are permitted
2. ESD-certified equipment — vacuum cleaners with HEPA filters (min. H13), grounded hoses and carts
3. Access procedures — every intervention is logged in the access control system; personnel trained in IT security
4. Environmental parameter control — maintaining relative humidity of 40–60%, temperature within server room tolerance (typically 20–24°C)

In Class A office buildings that we service as part of comprehensive office building cleaning, data centers constitute a segregated zone requiring separate procedures, access schedules, and personnel certifications.

Anti-Static Requirements and Dedicated Equipment

An electrostatic discharge (ESD) of just tens of volts can damage electronic components. Therefore, all equipment used in a data center must be certified for ESD protection. This includes:

• Anti-static vacuum cleaners — equipped with conductive hoses and nozzles, grounded housings, HEPA H13 filter retaining 99.95% of particles ≥0.3 µm
• Carts and mops made of conductive materials — grounded frame, wheels with conductive rubber, no components generating static charge
• Microfiber cloths with controlled conductivity — non-sparking, reusable, washed in machines without fabric softener
• ESD protective clothing and footwear — jumpsuits with conductive fibers, shoes with charge-dissipating soles

In practice, this means that a standard office vacuum cleaner cannot be used in a data center—the risk of generating an electrostatic spark when vacuuming dust is real. Cleaning personnel must also wear anti-static wrist or ankle straps, and in some data centers, they enter rooms through ESD portals with grounding control.

Beyond equipment, cleaning agents are important. Products with low conductivity cannot be used, as they may leave an insulating layer on conductive surfaces. Only specialized anti-static aerosols or solutions with controlled ionization are permitted, applied exclusively to external cabinet surfaces, not inside racks.

Reefa uses Kärcher industrial vacuum cleaners from the NT series with HEPA filters and grounding options, ensuring compliance with ESD requirements and effective removal of fine dust particles from panel floors and sub-floor spaces.

Humidity Control and Temperature — Why Are Environmental Parameters Critical?

A data center maintains precisely controlled environmental conditions. According to ASHRAE TC 9.9 standard, relative humidity should be in the range of 40–60%, and temperature in Class A1 is 15–32°C (acceptable range), with recommendation of 18–27°C (desired range). Even brief deviations can result in:

• Excessively low humidity (<40%) — increased risk of electrostatic discharges that can damage RAM, processors, or network interfaces
• Excessively high humidity (>60%) — condensation of water vapor on cold surfaces, corrosion of connectors, microbial growth on HVAC filters
• Temperature exceedance — server overheating, CPU throttling, hard disk failure

During cleaning, it is crucial not to introduce moisture sources into the facility. Wet floor washing—a standard procedure in office building cleaning—is prohibited in an active server room. If it is necessary to remove a stain or contamination, a minimal amount of anti-static product is used and immediately dried with a microfiber cloth.

In precision air conditioning systems (CRAC—Computer Room Air Conditioning), filter changes and ventilation duct cleaning occur on a separate schedule, often quarterly, coordinated with the IT administrator. A cleaning intervention does not involve shutting down HVAC units but may require brief air flow limitation in segregated zones.

Reefa cooperates with facility managers in synchronizing cleaning schedules with climate system service windows, minimizing the risk of environmental parameter fluctuations.

Access Protocols and IT Security Certificates

A server room is a facility with elevated physical and information security requirements. According to ISO/IEC 27001:2022 (information security management), access to critical facilities must be:

1. Controlled — access card systems, biometrics, entry/exit logs
2. Restricted — list of authorized persons approved by the IT security administrator
3. Documented — every entry recorded in a log with date, time, name, and purpose of visit
4. Monitored — CCTV surveillance, presence of IT personnel during external interventions

For a cleaning company, this means:

• Signing a confidentiality agreement (NDA) and a personal data processing attachment (RODO)
• Conducting health and safety and IT security training for personnel who will have access to the data center
• Obtaining a security certificate or statement of good standing for key team members
• Providing a dedicated coordinator who will be the contact point for the IT administrator

In practice, cleaning is performed in the presence of an authorized client employee or under surveillance by a monitoring system. Every member of the cleaning team must wear a visible ID and comply with the prohibition of removing any items from the facility without authorization.

Reefa provides a dedicated coordinator for each facility, serving as the first point of contact for the facility manager and managing access schedules to critical rooms. All employees are legally employed and insured, facilitating formal procedures for data center access.

Data Center Cleaning Frequency — Monthly or Quarterly?

Intervention frequency depends on several factors:

• Room classification — production data centers (24/7 uptime) require monthly cleaning, backup server rooms (cold standby) can be cleaned quarterly
• Traffic intensity — facilities with frequent personnel access (e.g., a server room in company headquarters) accumulate more dust than closed data centers
• Air filtration quality — HVAC systems with F7-F9 filters (ePM1 per ISO 16890) require less frequent intervention than standard air conditioning
• Compliance requirements — some industries (finance, healthcare) mandate minimum quarterly cleanliness audits per security policy

The most commonly used schedules are:

In each case, a pre-intervention audit is conducted before work begins—a visual inspection of the facility's condition, photographic documentation, and measurement of basic environmental parameters (temperature, humidity, dust levels). After cleaning, measurements are repeated and a post-audit report is prepared for the facility manager and IT administrator.

Reefa provides photographic reports after each cleaning session, with timestamp and geolocation, allowing real-time verification of service quality and archiving compliance evidence in facility management systems.

Scope of Cleaning — From Vinyl Floors to HVAC Ventilation

The typical scope of work in a data center includes:

Panel and Vinyl Floors

A raised floor is a system of panels mounted on a frame, creating sub-floor space for cables and cold air. Cleaning includes:

• Vacuuming panel surfaces with an anti-static vacuum cleaner using a soft nozzle (to avoid scratching the coating)
• Removing dust from edge strips and gaps between panels
• Cleaning under the floor (every 6–12 months) — requires dismounting selected panels, removing dust from cables and supporting structure

Vinyl floors (in smaller server rooms) are cleaned dry, using an electrostatic dust mop or microfiber cloth, without water.

Cable Trays and Rack Surfaces

Cable trays above servers and the side and top surfaces of server racks accumulate dust that can be drawn in by server fans. Cleaning includes:

• Wiping cable trays with an anti-static microfiber cloth
• Removing dust from rack surfaces (we do not open rack doors—that is the IT department's responsibility)
• Visual inspection of cable labeling condition; no interference with network infrastructure

Ventilation and Air Conditioning (HVAC)

Filters in CRAC/CRAH units require regular replacement or cleaning. Depending on the contract with the client, the cleaning team may:

• Replace air filters (if they are replaceable type and the client provides new ones)
• Vacuum intake and exhaust grilles
• Remove dust from external cooler units (if located in the technical room)

Work on HVAC systems requires coordination with the IT administrator to avoid temporary temperature or humidity increases.

Additional Surfaces

• Light strips and ceiling structural elements
• Entry doors and frames (particularly door seals)
• Cold aisle and hot aisle corridors in server layouts with thermal separation
• Anti-static entrance mats (cleaned dry)

In facilities where we manage comprehensive office cleaning in Cracow and Katowice, data centers are treated as special zones with separate schedules, teams, and reporting procedures.

ISO 27001 Compliance and Audit Documentation

ISO/IEC 27001 is an international information security management standard. For data center cleaning, the following controls are key (Annex A):

• A.7.1 Physical security perimeters — control of access to critical facilities
• A.7.2 Physical entry controls — identity verification procedures, access logs
• A.11.1 Operational procedures and responsibilities — documented procedures for operational activities (including cleaning)
• A.11.2 Protection from malware (indirectly) — prevention of introducing external media or unauthorized devices

In practice, implementing compliance requires:

1. Operational procedure — a written document describing the cleaning process step-by-step, list of permitted equipment, prohibitions and requirements
2. Intervention register — every cleaning session documented with date, time, names of personnel, scope of work
3. Photographic reports — before and after, showing areas covered by cleaning
4. Personnel training — certificates of training in IT security, data protection, health and safety in technical facilities
5. NDA and RODO contracts — commitment to confidentiality and data processing in compliance with RODO regulations

A cleaning company should be prepared for audit by the client or certifying body, which means:

• Availability of procedure documentation and reports in electronic and paper form
• Ability to verify personnel competencies (certificates, statements)
• Liability insurance covering potential IT infrastructure damage — Reefa carries PLN 500,000 coverage, ensuring client protection in case of equipment failure

For facility managers, it is important that the service provider can present a compliance matrix—a summary of ISO 27001 requirements with specific procedures implemented in the cleaning process.

Facility Manager Checklist — How to Prepare Your Data Center for Cleaning?

The following checklist helps ensure smooth and safe intervention:

Before cleaning (T-7 days):

• Date and time window approved by IT administrator
• List of authorized persons submitted to security department
• Verification of cleaning team certifications and training
• Access preparation (cards, codes, keys)
• IT team notification of planned intervention

Cleaning day (T-0):

• Cleaning coordinator meeting with IT representative on-site
• Pre-intervention audit — temperature, humidity measurement, photo documentation
• Equipment check (ESD, HEPA filters, microfiber)
• Work commencement per procedure, entry/exit logs
• Monitoring of progress (CCTV or IT personnel presence)

After cleaning (T+0):

• Post-intervention audit — parameter measurement, photo documentation
• Intervention report submitted to facility manager
• Access return, completion protocol signature
• Entry in intervention log in facility management system

Quality control (T+1 to T+7):

• Photo report verification against cleanliness standards
• Confirmation of no technical incidents (environmental monitoring logs)
• Next intervention schedule update
• Documentation archiving for compliance and audit purposes

The checklist can be integrated with a QR-based reporting system — Reefa offers a solution enabling facility managers to track request status in real time and report observations.

Case Study: Data Center in a Cracow Class A Office Building

In 2025, Reefa's team began managing a data center located on the fifth floor of a modern office building in Cracow with over 12,000 m² of office space. The data center occupies 85 m² and supports IT infrastructure for three tenants—companies from the financial and technology sectors.

Project Challenges

• 24/7 access — no possibility of system shutdown; intervention only possible during night hours (00:00–05:00)
• ISO 27001 requirements — tenants hold information security certification, requiring full documentation of procedures and reports
• Panel floor — 85 m² of anti-static panels, sub-floor space approximately 40 cm, dense cable network
• Precision air conditioning — two CRAC units with replaceable F9 filters, real-time temperature and humidity monitoring

Implemented Solution

1. Team certification — two-person team completed health and safety training and IT security briefing by facility administrator; signed NDA and RODO agreement
2. Access protocol — before each intervention, coordinator submitted personnel list to security department, received single-use access cards valid for 5 hours
3. Pre/post audit — photographic documentation of minimum 20 control points (rack surfaces, floor, cable trays, CRAC filters), humidity and temperature measurement with certified hygrometer
4. ESD equipment — Kärcher NT 50/1 HEPA vacuum, grounded cart, anti-static microfiber, ESD wrist straps
5. Monthly schedule — intervention on the first Saturday of the month, 03:00–05:30, IT administrator present remotely (CCTV monitoring)

Results and KPIs

• Zero incidents — since partnership began (12 months), no equipment failure or security breach reported
• Environmental parameters — temperature and humidity maintained within standard range (pre/post measurements showed no deviation >1%)
• Compliance documentation — photographic reports and intervention logs archived in facility manager's system, available for ISO 27001 audit
• Customer satisfaction — facility manager confirmed contract renewal for another year with option to expand scope to additional technical facilities

The project demonstrates that data center cleaning is a managed process where procedures and documentation are as critical as cleaning technique.

Rates and Cooperation Model — How Much Does Data Center Cleaning Cost in 2026?

Service pricing depends on:

• Facility size — data centers from 20 m² (small company) to hundreds of m² (major data center)
• Intervention frequency — monthly, bi-monthly, quarterly
• Scope of work — whether it includes sub-floor space cleaning, HVAC filter replacement, rack cleaning
• Compliance requirements — need for personnel certification, audit reports, additional insurance

Estimated rates for Cracow and Katowice market in 2026:

For facilities where we manage comprehensive building cleaning—e.g., office building cleaning in Katowice—the data center can be included in a facility management package at preferential rates.

The cooperation model includes:

• Framework agreement with detailed attachment (SLA) defining KPIs, schedule, procedures
• Dedicated coordinator — contact point for facility manager, schedule management, incident escalation
• Access to reporting platform — photo reports, intervention logs, environmental measurements available online
• Liability insurance up to PLN 500,000 — coverage for potential IT infrastructure damage

We prepare pricing for a specific facility after a technical audit and discussion with the IT administrator — contact our team via contact form to schedule a free site survey.

Frequently Asked Questions

Can data center cleaning be performed without shutting down servers?

Yes, professional data center cleaning occurs without turning off IT infrastructure. Procedures rely on anti-static equipment, dry cleaning methods, and work in passive zones (floor, cable trays, external rack surfaces). Internal cleaning of servers and network switches remains the responsibility of the IT team and is performed independently. Before starting work, we coordinate the schedule with the administrator to avoid backup windows, system updates, or other critical operations. In data centers with SLA 99.99% uptime requirements, we schedule interventions during night hours or weekends when system traffic is minimal.

What certifications should data center cleaning personnel have?

Personnel should complete training in IT security awareness, basic data protection (RODO), health and safety in technical facilities, and anti-static equipment (ESD) handling. Depending on client requirements, certificates of good standing or security clearance issued by the protection department may be necessary. The cleaning company should be ready to present training documentation, current employment contracts for all team members (legally employed personnel), and liability insurance covering IT equipment damage. In facilities with ISO 27001 certification, a written operational procedure approved by the information security administrator is required, along with availability for client audit of documentation.

How often should the sub-floor plenum in a raised floor data center be cleaned?

The sub-floor plenum accumulates dust, cable insulation fragments, and debris introduced by IT personnel during installation work. Recommended cleaning frequency is once every 6–12 months, depending on traffic intensity and air filtration quality in the HVAC system. The procedure includes dismounting selected panels (typically every 3–4 meters), vacuuming cables and supporting structure with a HEPA vacuum, removing loose objects, and checking grounding condition. Plenum cleaning requires IT administrator coordination, as cables in this area may be active, and accidental disconnection could cause failure. After work, all panels are remounted in sequence (they are often marked to distribute load).

Can a steam vacuum be used in a data center?

No, a steam vacuum is absolutely prohibited in a data center. Water vapor significantly increases relative humidity, potentially causing condensation on cold surfaces, connector corrosion, and increased short-circuit risk. Even in inactive facilities (e.g., data centers during startup or decommissioning), steam use is risky because moisture can seep into hard-to-reach areas (under floor panels, into ventilation ducts) and persist for many hours. The only permitted cleaning method in a data center is dry vacuuming with anti-static equipment with HEPA filter, and wiping surfaces with dry or minimally moistened microfiber cloths (prepared with anti-static aerosol spray). For exceptional soiling, specialized products are used in minimal quantities, with immediate drying.

What does an emergency cleaning procedure look like after air conditioning failure or flooding?

In case of an incident (e.g., flooding from a broken pipe, CRAC unit leak), emergency cleaning procedure requires immediate coordination with the IT administrator and security department. The first step is to cut power in the affected zone (if needed) and secure the incident source. Then the cleaning team removes water using wet/dry vacuums (only in safe zones, away from powered racks), dries surfaces with dry towels, and activates air dryers with humidity control. Maintaining environmental parameters is critical—drying cannot raise temperature above acceptable standards. After water removal, infrastructure condition is checked (cable moisture, server condensation), photographic reports prepared, and insurer cooperation initiated. Reefa carries PLN 500,000 liability insurance covering responsibility for damage during intervention, but external infrastructure damage (building systems) is the responsibility of the building manager.

Does data center cleaning require exclusive use of the facility?

In most cases, yes—for physical and information security reasons, it is recommended that only authorized cleaning personnel and (optionally) a client IT representative be present in the data center during cleaning. Presence of unauthorized persons increases security incident risk (unauthorized data access, accidental cable disconnection) and complicates environmental parameter control (heat from additional people, contamination risk). In smaller data centers, the cleaning company can work independently under CCTV surveillance, with entry/exit protocols verified by the security department. In larger data centers, an IT administrator may accompany the team or monitor intervention remotely via cameras and environmental sensors in real time. It is important to agree in the SLA contract whether the client provides personnel presence or whether the cleaning company bears sole responsibility for procedure compliance.

Data center cleaning is a specialized service requiring technical competencies, IT security procedures, and ESD-certified equipment. If you manage a facility with server infrastructure and are seeking a provider guaranteeing ISO 27001 compliance, full audit documentation, and a team experienced in critical environments, contact us to discuss project details and receive a free quote tailored to your data center's needs.