Security and Physical Access Control
What the domain tests
Security and Physical Access Control tests layered defence of the facility and the evidence trail that proves it works. Expect questions on perimeter design, access control technology, anti-tailgating, video surveillance, visitor management, colocation cages and the standards that impose physical controls, notably ISO/IEC 27001 Annex A, PCI DSS Requirement 9 and SOC 2.
Layers and deterrence
The classic model is concentric layers: site perimeter, building envelope, data hall, rack or cage. Each layer has its own control and its own detection. Vehicle barriers, bollards, lighting, clear zones and CCTV deter and detect at the perimeter; mantraps and interlocking doors control the transition into secure space. Crime prevention through environmental design supports natural surveillance and defined ownership of space.
Access control technology
Credentials include cards (proximity, smart card, MIFARE DESFire), PINs and biometrics (fingerprint, iris, palm vein). Multi-factor means combining different types, such as card plus PIN or card plus biometric. Anti-passback prevents credential sharing and tailgating. Fail-safe locking releases on power loss for egress; fail-secure locks stay locked, which is appropriate only where life safety codes permit and a mechanical exit exists. Records must be retained and reviewed; PCI DSS expects at least three months of video retention in sensitive areas.
Worked example
A colocation customer rents a cage inside a shared hall. The hall has badge access and anti-passback. Is the cage secure? No. Any hall occupant can walk to the cage, and tailgating through the hall door defeats badge control entirely. Correct design: a cage door with its own reader requiring card plus PIN or biometric, hinge and latch protection, cage mesh and roof, and camera coverage of the cage door with recorded retention. Add a mantrap at the hall entrance with interlocked doors and weight detection to stop piggyback entry. The reasoning is that each trust boundary needs its own authentication and its own detection.
Traps that cost marks
Treating CCTV as a preventive control when it is detective; calling two cards two factors; ignoring privacy law and retention limits for video; and forgetting that egress doors must release on fire alarm.