I85PREP
⌘ K
EXIN Information Security Essentials study materials
EXIN Information Security Essentials study resources

EXIN Information Security Essentials: Physical and Environmental Security

EXIN Information Security Essentials · Work through your exam, one topic at a time.

All guide sections

Physical and Environmental Security

Physical and environmental controls protect premises, rooms, equipment and media, and keep systems running when the environment misbehaves. The exam tests layered defence and the purpose of individual controls - particularly whether a control is preventive or detective.

Layers and access control

  • Perimeter: fencing, bollards, lighting, signage, guards, CCTV, intruder alarms. CCTV and alarms are detective, not preventive.
  • Building and room: locks, badge readers, biometrics, mantraps or interlocking doors that defeat tailgating, and a controlled reception.
  • Visitors: verify identity, sign in, issue a distinguishable badge, escort at all times, log departure.
  • Equipment: locked racks and cabinets, cable locks, disabled ports, asset tagging.
  • Media: cross-cut shredding, degaussing (magnetic media only - useless on SSDs and flash), physical destruction, and certificates of destruction for audit.
  • Clear desk and clear screen policies reduce shoulder surfing and document theft.

Environmental controls

  • Temperature and humidity control: too dry causes static, too damp causes condensation.
  • Fire: detection (smoke, heat, aspirating VESDA) plus suppression. Water sprinklers suit general areas; data centres use clean agents (inert gas, FM-200). Never use water on live electrical equipment.
  • Power: UPS for ride-through, standby generator for prolonged outage, surge protection, diverse power feeds.
  • Flood and water-leak detection; avoid basements and pipe runs overhead; seismic bracing where relevant.

Worked example

A server room protected by water sprinklers risks destroying the servers even for a small fire. Replace with cross-zoned smoke detection - two detectors must trigger, reducing accidental discharge - and a clean-agent suppression system, add UPS and generator support for servers and cooling, and keep portable extinguishers outside the room. The reasoning is that suppression must not cause more damage than the fire, and detection should act before combustion spreads.

Traps that cost marks

  • Listing CCTV as a preventive control.
  • Believing degaussing sanitises solid-state drives; physical destruction is required.
  • Specifying water suppression for a data centre.
  • Ignoring media in transit, at home with remote workers, or awaiting disposal.