Physical Security and Facility Protection
Physical Security and Facility Protection covers the facility layer of defence: perimeter, building envelope, interior zones, high-value storage and the dock. The exam asks you to select controls that match the threat and to know the operational disciplines that make hardware work.
Layered design and CPTED
- Layers: site boundary, building envelope, interior zones (office, production, storage), high-value cage, then the item itself.
- Crime prevention through environmental design: natural surveillance, natural access control, territorial reinforcement, maintenance. Clear sightlines, trimmed landscaping, no parking against fences.
- Fencing, gates, bollards, anti-ram protection, lighting and signage provide deterrence and delay; they buy response time.
Detection, delay and response
- The delay created by barriers must exceed detection-to-response time, or the control chain fails.
- Intrusion detection on doors, windows, skylights, roof hatches and perimeter, with monitored alarms, a documented response and an updated call list.
- CCTV covering gates, docks, seal application and verification, high-value storage and IT or cash rooms, with defined retention, controlled access to footage, and export under chain of custody.
- Access control: badge plus PIN or biometric for critical zones, anti-passback, visitor management with escort, contractor logs, key and seal custody registers, and prompt termination of access rights.
Dock and storage discipline
- One trailer door open at a time; drivers wait in a designated area; no unauthorised entry beyond the dock face.
- Seal control: dual custody, sequential seal log, seal applied and number recorded on camera.
- Separate shipping from receiving; high-value cage with individual authorisation and cycle counts.
- Control trash compactors, scrap and employee exits - a classic removal route.
Worked example
A high-value cage shows repeated inventory variance with no forced entry. Reasoning: no entry damage means access by a key holder or through paperwork. Badge and key logs show three people can enter alone, and one of them performs the cycle counts. Controls: two-person rule, count rotation, camera coverage on the cage door, and reconciliation to shipping documents. The variance pattern, not the hardware, was the evidence.
Traps
One control treated as sufficient; guards with no post orders or training; alarms nobody responds to; footage overwritten before investigation; unsecured trash or fire exits; and mixing receiving with shipping so custody becomes untraceable.