Access Control Fundamentals and Risk Assessment
This domain tests whether you can tie access control decisions to a defensible risk assessment rather than to hardware preferences. Expect questions on asset identification, threat and vulnerability analysis, defense in depth, risk treatment, residual risk, and how access control fits a broader physical security program.
Core method
- Define scope and assets: people, information, equipment, reputation, and continuity.
- Identify threats such as outsider intrusion, insider misuse, tailgating, credential theft, coercion, and cyber-physical attack.
- Identify vulnerabilities such as unmonitored doors, propped doors, shared PINs, weak enrollment, poor lighting, and slow response.
- Estimate risk with a matrix using likelihood and consequence, then rank high, medium, or low.
- Select treatment: avoid, reduce, transfer, or accept. Access control usually reduces likelihood; monitoring and response reduce consequence.
- Record residual risk and obtain risk-owner sign-off.
Worked example
A server room has one card reader, a door frequently propped by cleaning staff, and no door-position sensor. Unauthorized-entry likelihood is high because tailgating is easy; consequence is high because the room holds core network gear. The rating is high. Adding a door position switch, held-open alarm, camera coverage, and a clean-room policy reduces likelihood and improves detection, but does not eliminate insider risk. Document residual risk as medium and review after 90 days.
Traps
Do not treat a card swipe as proof of identity. Do not assume compliance equals security. Do not ignore insiders, coercion, or emergency egress. Do not present a single risk score without assumptions. Do not accept risk without the asset owner's authority.