Physical Security and Access Control
Physical Security and Access Control tests the hardware and procedures that stop unauthorised people, vehicles and materials from entering or leaving a premises.
Layered physical security
- Perimeter: wall, fence, gate, lighting, signage, with a clear zone so nothing blocks the view along the fence.
- Shell: doors, windows, grilles, locks, seals.
- Interior: reception, turnstiles, escorted movement, restricted zones.
- Asset: store, strong room, server room, armoury - two-person rule and separately controlled keys.
Access control procedure
- Stop every person and vehicle at the stop line.
- Verify identity against a valid photo ID and a genuine pass; check the pass date, time window, area and escort requirement.
- Confirm the purpose; issue a visitor badge that must be worn visibly.
- Search as per policy - male guards frisk males, female guards frisk females; baggage through the scanner.
- Record entry and exit times and recover the badge at exit.
- Watch for tailgating (following closely behind an authorised person) and piggybacking (entry on someone else's card).
Worked example
A technician arrives at 21:00 to repair a server. His pass is valid but only for 09:00–18:00. Reasoning: the pass is genuine but not valid at that time, and after-hours access needs an approved call-out. Correct action: do not admit; phone the shift supervisor and the client's authorised contact, admit only after approval is logged, and keep the technician escorted throughout.
Traps that cost marks
- Accepting a photocopy or an expired pass.
- Letting a senior manager skip the search 'because of rank'.
- Leaving the boom barrier up during a shift change.