Physical Security and Access Control
Physical security and access control tests whether you can apply layered defences and a consistent identify–verify–authorise–record routine at every entry point.
Layers and the access habit
Security works in layers: perimeter fence and lighting, then the gate, then the building entrance, then the inner room. Each layer buys time. Access control is a repeatable four-step habit: identify (who are you), verify (ID, pass, appointment list), authorise (does the site manager allow it), and record (log in and out).
Practical controls
- Visitors: pass visible, escorted, logged, badge returned on exit.
- Vehicles: check driver, passengers, load, boot, and underside where policy requires.
- Keys: signed in and out, never left in locks, master keys logged.
- Tailgating: politely challenge anyone who slips through a door; never hold a door for an unverified person.
- Contractors: work permit, tools in and tools out, hot-work permit for welding or grinding.
Worked example
A plumber arrives saying "the manager called me." Reasoning: identity is unverified, so check the approved contractor list; there is no entry, so telephone the site manager; if approved, issue a visitor pass, log name, NIC number, company, time in and tools, escort him to the work area, then log him out and check the tools back. Never let a stranger walk unescorted "just for five minutes."
Traps that cost marks
- Recognising a face and skipping the pass.
- Incomplete log entries with no time out.
- Two people entering on one pass.
- Checking an ID but not matching the photo to the person.