Physical Security Assessment
Purpose and flow
A physical security assessment establishes a defensible link between what you are protecting, the threats that could act against it, and the weaknesses that make loss credible. Start with asset identification and criticality: people, information, operations, reputation, and property. Then characterize the site, including perimeter, building envelope, interior spaces, utilities, and existing controls. Develop or confirm a design-basis threat (DBT) so the analysis has a stated threat profile rather than an undefined worry.
Core concepts
Assess threat, vulnerability, and consequence separately. Threat is the adversary or hazard; vulnerability is a weakness or absence of control; consequence is the impact if loss occurs. Risk is commonly expressed as a function of likelihood and consequence, with vulnerability influencing likelihood. Use qualitative ratings when data are thin, quantitative methods when credible values exist, and document assumptions. The output is not a shopping list of cameras; it is a prioritized risk register with performance objectives, recommended mitigations, and residual-risk statements. Distinguish compliance findings from risk findings-meeting a code does not mean the asset is adequately protected.
Traps
Candidates confuse threat with vulnerability, treat a security survey as a one-time event, or jump to countermeasures before defining risk. Another trap is assuming a high-value asset is automatically the highest risk; likelihood and consequence matter. Do not treat an annual review as sufficient if the threat or operations change.
Rule of thumb
Rank by risk, then by residual risk after mitigation, not by ease of purchase. If a recommendation cannot be tied to an asset, threat, vulnerability, and consequence, send it back for analysis.