Physical Security and Access Control
What the domain covers
This domain tests how layers of physical security protect a site and how access is granted, refused, recorded and reviewed. Expect questions on perimeter barriers, lighting, locks, CCTV, visitor management, badges, vehicle control and key control.
Core rules and concepts
- Use layered defence: perimeter, building exterior, internal zones, restricted rooms and asset storage. Each layer slows or detects intrusion.
- Access control follows the principle of least privilege: people receive only the access needed for their role. Visitors need identification, purpose, host confirmation, badge and escort where required.
- Three checks matter at a gate: identity, authorisation and purpose. Record name, organisation, time in, time out, vehicle number and items carried where policy requires.
- Tailgating and piggybacking are common failures. One badge should admit one person; challenge politely when someone follows through a door.
- Key control requires a register, signed issue and return, and secure storage. Lost keys must be reported immediately.
- CCTV supports investigation and deterrence but does not replace guards, locks or procedures.
Worked example
An employee holds the door for two people carrying boxes into a restricted store. The guard should politely ask both to use the visitor entrance, verify identity and host approval, and check the boxes against an authorised removal or delivery note. If approval is absent, the guard stops the movement and calls the supervisor. Reasoning: a familiar face is not authorisation, and the boxes are an asset risk. The event is logged even if approval is later confirmed.
Traps that cost marks
Do not rely on CCTV alone. Do not allow a visitor to enter merely because they wear a uniform or carry a laptop bag. Do not leave master keys unattended or lend them without a signature. Do not confuse a visitor badge with unrestricted access.