Physical Security Assessment and Planning
Domain 1 - Physical Security Assessment and Planning. This domain tests whether you can turn business risk into a defensible physical protection plan: scoping the assessment, collecting site data, defining the design-basis threat, and selecting layered countermeasures with measurable performance criteria.
Core rules
- Sequence matters: identify assets and criticality, characterize threats, assess vulnerabilities, then estimate risk. A vulnerability is a weakness; a threat is an actor or hazard. Do not merge them.
- Use a design-basis threat (DBT) to bound design: credible weapons, tactics, insider involvement, and expected warning time. Without a DBT, every countermeasure looks either excessive or insufficient.
- Design in layers: site perimeter, building envelope, interior zones, and high-security compartments. Each layer should delay, detect, or deny, and should not depend on a single control.
- Apply CPTED: natural surveillance, natural access control, territorial reinforcement, and maintenance. CPTED complements, not replaces, engineered security.
- Site survey data should include approach routes, standoff, parking, utilities, sightlines, adjacent occupancies, egress paths, and existing operations.
Worked example
A data center assessment finds the only public parking row 10 m from a curtain-wall facade. The threat is a vehicle-borne improvised explosive device; consequence is high; likelihood is low but credible. Cameras alone do not reduce blast vulnerability. The defensible recommendation is to relocate parking, add certified bollards at a tested standoff, and document residual risk if lease constraints prevent full compliance. The plan should state performance (tested barrier rating and standoff), owner, budget, and review date.
Traps
Treating a checklist as an assessment; proposing cameras for every finding; ignoring life-safety egress, accessibility, or fire code; and failing to record risk acceptance.