Physical Security and Access Control
Purpose and layers
Physical security uses layers to delay, detect and deny unauthorised access. The exam tests perimeter protection, zoning, access points, visitor management, search procedures and the difference between deterrence and detection. Good access control is simple, consistent and auditable.
Core rules
- Define zones: public, controlled, restricted and high-security; each needs its own rule.
- Use a single controlled entrance where possible; keep emergency exits alarmed but usable.
- Check identity, purpose and authority before issuing a pass; log name, time, host and badge number.
- Escort visitors in restricted areas; require visible badges for staff and contractors.
- Prevent tailgating and piggybacking with turnstiles, mantraps, guards or awareness training.
- Control keys and access cards: issue, record, recover and audit them.
- Search bags or vehicles only under posted policy, consent or legal authority; maintain dignity and witnesses.
Worked example
A delivery driver arrives at a factory gate without a pass and says the storekeeper is expecting him. The guard should not wave him through because he “looks regular.” He calls the storekeeper, confirms the delivery, issues a visitor pass, records the vehicle number, directs the driver to the goods entrance, and arranges an escort. The vehicle is checked according to policy before entry.
Traps that cost marks
- Treating familiarity as authorisation.
- Blocking or locking emergency exits to control access.
- Allowing tailgating because “the first person had a badge.”
- Failing to record pass issue and return.