Don't Panic - Physical Security Assessments

A physical security assessment is an authorized check of the controls that protect buildings, rooms, and the systems inside them. Think doors, badges, visitor desks, cameras, and the boring lists of who is allowed where. The job is to measure those controls under agreed conditions, not to collect lobby war stories or to rank receptionists.

NIST frames this as planned information security testing and assessment. The Physical and Environmental Protection controls give you a map of what "good" often looks like: authorizations, access enforcement, visitors, monitoring, and related facility protections. Your first artifact is still rules of engagement. Sites, methods, exclusions, evidence rules, contacts, and stop conditions go on paper before anyone leans on a door.

Assessors usually mix three methods. Examine reads policies, diagrams, authorization lists, and logs. Interview asks how escorts and exceptions really work. Test exercises a named control in a supervised, reversible way. Prefer the least intrusive method that answers the question. A camera plan that looks perfect on paper can still miss a stairwell; a visitor policy that sounds strict can still issue employee-lookalike badges.

Write findings as control statements. "Revoked media still opens the lab door" is useful. "People are careless" is not. Restore everything you touched. Keep real alarms and emergency egress real during the window. Then fix the ownered gap and retest the same point.

Read the Intro for the full control loop. Use the Cheatsheet when you need the method and evidence map. Landscape places PACS, video, and credential platforms beside authorized RFID tooling; Updates tracks the NIST publications this course uses for assessment planning and PE-oriented control mapping.