Physical Security Guide for Security Teams

Physical access defeats most logical controls, and the systems that guard doors and record cameras are now networked computers with their own vulnerabilities, accounts and admin consoles. A person who reaches an unlocked comms room, plugs a device into a meeting room port or walks out with a backup drive bypasses firewalls and MFA altogether. This guide covers how security teams scope and assess physical risk, layered site protection, electronic access control and badge technology, CCTV under data protection law, data centre and office controls, and the convergence of physical and cyber security, including the service accounts and controllers that run physical security systems. It is written for CISOs, security architects and GRC teams who own physical controls under ISO/IEC 27001 or NIST SP 800-53 but are not facilities specialists. The content is defensive only.

Key takeaways

Layer the site. NPSA's Deter, Detect and Delay principles, backed by a rehearsed response, mean that no single door, guard or camera has to be perfect.
Treat access control as IT. Controllers, readers, head-end servers and video recorders are networked devices that appear in the CISA Known Exploited Vulnerabilities catalogue and need patching, segmentation and credential management like any server.
Badge strength varies widely. Legacy proximity cards and unencrypted Wiegand wiring give little assurance; smart credentials with cryptographic authentication and OSDP Secure Channel give much more.
CCTV is personal data processing. Under UK GDPR, the ICO expects a DPIA before deployment, signage before people enter the area, purpose-based retention and audio off by default.
Converge the data, not just the org chart. Joining badge, HR and logon data catches impossible travel, tailgating patterns and leaver badges that still open doors.

Scoping physical security risk

Start from what you are protecting and from whom, not from a list of products. A practical scope covers four asset groups:

People: staff, visitors and contractors on site, including lone workers and reception.
Information assets: data centres, server and comms rooms, network cabinets, printers, paper records and removable media.
Physical security systems themselves: access control servers, controllers, readers, video management systems, network video recorders (NVRs), cameras and alarm panels.
Supporting utilities: power, cooling, water and fire suppression that keep systems running.

Threats include opportunistic theft, tailgating and social engineering at reception, insiders misusing legitimate access, hostile reconnaissance before an attack, and remote compromise of the physical security systems. On the cyber side, MITRE ATT&CK lists T1200 Hardware Additions (adding a device such as a network implant or keystroke injector to a system or network) and T1091 Replication Through Removable Media, both of which depend on physical access. Run the assessment jointly with facilities so that one risk register covers both views. See the Insider Threat Programme Guide.

Layered site protection

ProtectUK guidance, built on NPSA principles, describes defence in depth: if one layer fails, another still stops or slows a threat. Each layer should do at least one of four jobs:

Principle	Purpose	Typical controls
Deter	Make the site look like a hard target	Visible, professional staff; patrols at irregular times; clear boundaries and signage; good lighting
Detect	Know quickly that something is wrong	Perimeter intrusion detection, door-forced and door-held alarms, monitored CCTV, alert staff trained to challenge
Delay	Slow the intruder until response arrives	Fences, robust doors and locks, turnstiles, secure rooms and locked cabinets inside the building
Respond	Act on the alert	Security operations or guarding procedures, escalation to police, lockdown plans, incident logging

ProtectUK makes three practical points worth adopting: keep entry points to a minimum and staff them; make access systems "physically robust and cyber secure"; and recognise that CCTV is only effective if it is actively monitored and well maintained. A camera nobody watches is evidence after the fact, not detection.

Electronic access control and badge technology

A physical access control system (PACS) has four tiers: the credential (card, phone or biometric), the reader at the door, the controller or panel that decides and drives the lock, and the head-end server, database and workstations that hold the policy. NIST SP 800-116 Rev. 1 treats those servers, databases and workstations as IT systems requiring information system security controls.

Credential and wiring assurance

Technology	Assurance	Main weakness	Action
125 kHz proximity cards	Low	Static identifier with no cryptographic authentication, so it can be read and cloned	Plan migration; do not use for server rooms
Smart cards with a static card number only	Low to medium	Reader trusts a serial or identifier that can be copied; NIST SP 800-116 Rev. 1 says the CHUID mechanism alone gives "little or no" confidence	Configure readers to use cryptographic challenge and response
Smart cards with PKI or symmetric key challenge (for example PIV PKI-CAK)	Medium to high (one factor)	Card theft or loan	Add PIN or biometric for higher zones
Card plus PIN or biometric	High (two or three factors)	Cost and throughput at busy doors	Use for limited and exclusion areas
Mobile credentials	Varies by implementation	Depends on phone security and enrolment process	Require device lock and managed enrolment
Wiegand reader wiring	Low	Unencrypted, one-way signal between reader and controller	Replace with OSDP
OSDP with Secure Channel	High	Only if Secure Channel is actually enabled	Enable Secure Channel and supervised connections

The Security Industry Association describes OSDP (Open Supervised Device Protocol) as a more capable alternative to Wiegand: it is bidirectional, uses two wires, supervises connections so reader faults are visible, and its Secure Channel supports AES-128 encryption. It was published internationally as IEC 60839-11-5:2020, and SIA released version 2.2.2 in October 2024.

Zones and authentication factors

NIST SP 800-116 Rev. 1 sets a useful model even outside US government: controlled areas need one authentication factor, limited areas two, and exclusion areas three. Single-factor card authentication should not be used for limited or exclusion areas, and "authentication in context" (counting an outer door's check towards an inner one) is only acceptable with safeguards against piggybacking and tailgating. Map your zones the same way: general office (one factor), comms rooms and finance areas (two), data halls and key management rooms (three, or two plus escort and anti-passback).

Operational controls

Anti-tailgating: turnstiles or interlocking doors at high-security boundaries, door-held alarms, and a culture where staff challenge unbadged people. See the Security Awareness and Human Risk Management Guide.
Visitors: pre-registration, identity check on arrival, visible visitor badges, escort in secure areas and badge return. Log visits (NIST SP 800-53 PE-8).
Badge lifecycle: drive badge creation and removal from the HR record, the same way as directory accounts, so leavers lose door access the same day. See the Joiner-Mover-Leaver Guide.
Physical access reviews: review who can enter each high-security zone at least quarterly, with zone owners approving.

Physical security systems as networked OT and IoT

Access controllers, NVRs and IP cameras run embedded operating systems, web consoles and remote management services. They appear in the CISA Known Exploited Vulnerabilities catalogue: for example CVE-2019-7256, an OS command injection in Nice Linear eMerge E3-Series access controllers (added March 2024); CVE-2021-33044, an authentication bypass in Dahua IP camera firmware; CVE-2017-7921, an improper authentication flaw in multiple Hikvision products; and CVE-2022-23227, missing authentication in NUUO NVRmini2 devices. An attacker who controls the head-end can unlock doors, add badges or delete footage, and the device is often a foothold onto the corporate network.

Inventory: include every controller, reader, camera, NVR and alarm panel in the asset inventory with firmware version and owner. See the Asset Inventory and CMDB Security Guide.
Segment: place physical security systems in their own network zone, allow only the head-end to talk to controllers, and never expose management interfaces to the internet. See the Network Segmentation Guide.
Patch: bring physical security systems into vulnerability management, prioritising KEV-listed devices, and replace devices the vendor no longer supports.
Remote access: integrator and vendor remote access through your managed remote access path with MFA and session logging, not a modem or a vendor-installed tool. See the Third-Party Access Guide.

These systems sit closer to OT than to office IT: long lifetimes, vendor-controlled firmware and safety implications (doors must fail safe for fire egress). See the OT Security Guide.

Where identity fits

Physical security systems are full of non-human identities that rarely appear in IAM reviews:

Service accounts: the head-end server's database account, directory sync accounts that read HR or Active Directory to create badges, and integration accounts that feed events to the SIEM. Give each an owner, least privilege and a vault-held, rotated secret.
Device credentials: default administrator passwords on controllers, cameras and NVRs, and the shared installer account. Change defaults at commissioning, use unique per-device credentials and record them in the vault.
API keys and tokens: cloud-hosted access control and video platforms expose APIs for visitor systems and HR integration. Scope and rotate those keys. See the API Key Management Guide.
Device identity: certificates on readers and cameras for 802.1X or TLS. See the Identity for IoT Fleets Guide.

Admin rights in the access control console are privileged access: anyone who can add a badge to the data hall group can grant physical entry. Put console administrators under the same privileged access review as domain admins. See the Privileged Access Management Guide.

CCTV and data protection

Video surveillance that captures identifiable people is personal data processing. The ICO's video surveillance guidance (noted by the ICO as under review following the Data (Use and Access) Act) sets these expectations:

Requirement	ICO expectation	Security team action
DPIA	Carry one out before deployment; consider less intrusive alternatives and proportionality	Run the DPIA with the DPO before buying or extending cameras
Lawful basis	Article 6 basis documented, usually legitimate interests or public task; Article 9 or 10 conditions for biometric or criminal offence data	Record a legitimate interests assessment; treat facial recognition as special category processing
Transparency	Visible, readable signs before people enter the area, naming the operator, purpose and contact; a website alone is not enough	Audit signage at every monitored entrance
Retention	Set by purpose, not storage capacity or manufacturer defaults; delete securely and check deletion happens	Configure NVR retention explicitly and test it
Security	Restrict access, encrypt where possible, secure cloud storage and transfers, apply updates, keep audit trails	Named viewers only, MFA on the video console, export logging
Rights requests	Locate footage efficiently and redact third parties	Make sure the video system can search by time and camera and export with redaction
Audio	Off by default; only with evidenced need; exceptional in the workplace	Disable audio on cameras that support it

In the EU, the EDPB's Guidelines 3/2019 on processing personal data through video devices (final version January 2020) are the reference text. Biometric access control and facial recognition raise extra obligations, and in the US some states regulate biometric data directly. See the DPIA Guide, the Employee Monitoring and Privacy Guide and the Illinois BIPA and Biometric Privacy Guide.

Data centres, comms rooms and offices

Data halls and colocation: multi-factor entry with anti-passback, mantraps at the hall boundary, locked racks or cages, escorted contractors, and logged delivery and removal of equipment (NIST SP 800-53 PE-16). For colocation, obtain the provider's access logs and assurance reports and review who on your list can enter. See the Data Centre Security Guide.
Comms rooms and network cabinets: the most neglected layer in offices. Lock them, put them on the access control system rather than a shared key, and alarm the door.
Network ports: disable unused ports and use network access control in meeting rooms and reception so a plugged-in device does not reach the corporate network. See the Network Access Control (NAC) Guide.
Clear desk and clear screen: screen lock policy, locked storage for papers and a confidential waste process.
Equipment and media: encrypted laptops and removable media, secure disposal with certificates of destruction, and controls for equipment off premises.
Utilities and environment: UPS and generator testing, cooling, water detection and fire suppression appropriate to the room.

Convergence of physical and cyber security

CISA describes convergence as a holistic strategy that aligns cybersecurity and physical security functions with organisational priorities, and the Interagency Security Committee's best practice calls for a single coordinated effort with merged risk management planning, shared training and performance management. You do not need one reporting line to get the benefits. Start with shared data and joint processes:

Feed badge events to the SIEM: correlate door access with VPN and logon data to catch a user logging on from abroad while their badge is used on site, or the reverse.
Join HR, badge and directory: report badges active for people with no active HR record or disabled directory account.
Joint incident playbooks: a lost badge, a tailgating alert and a rogue device found in a meeting room are cyber incidents too.
One risk register: physical and cyber risks scored on the same scale so investment decisions compare like with like.

The same convergence logic applies to fraud. See the Fraud and Cyber Convergence Guide.

How to implement

Assess: walk every site with facilities; list zones, entry points, systems and current controls; run a joint risk assessment.
Fix the quick wins: lock comms rooms, change default device passwords, disable unused network ports, confirm leaver badges are disabled.
Bring systems into IT governance: inventory, segmentation, patching and vault-held credentials for controllers, NVRs and cameras.
Pilot integration: connect one site's badge events to the SIEM in monitoring mode for a month, tune false positives (shift workers, shared reception doors) before alerting.
Upgrade credentials and wiring in phases: high-security zones first, then high-traffic doors. Run old and new credentials in parallel at each door during cutover and keep the old configuration exported so a failed reader can be rolled back without leaving a door locked or open.
Close the privacy loop: DPIA, signage and retention configuration for every camera estate change.
Test: commission authorised physical penetration tests and tailgating exercises with written scope and authorisation letters, and fix findings.

Small and large organisations

A small organisation in a shared building often cannot change the landlord's system; focus on locking your own comms cabinet, clear desk, encrypted devices and getting leaver badge removal confirmed in writing. A large or regulated organisation needs zone-based authentication, OSDP Secure Channel, a segmented security systems network, SIEM integration and periodic independent testing. Cloud-hosted access control reduces on-premises server patching but adds an API and SaaS admin surface to secure.

Detection and measurement

Log door-forced and door-held alarms, denied badge attempts, badge use outside normal hours, visitor records, console administrator changes and video export events. Metrics that show the programme works:

Leaver badge latency: median hours from HR leaving date to badge disabled (target under 24 hours).
Orphaned badges: active badges with no matching active HR or contractor record (target zero).
Device hygiene: percentage of controllers, cameras and NVRs with supported firmware, no default credentials and no KEV-listed open vulnerability.
High-zone review: percentage of high-security zones with an access review completed in the last quarter.
Tailgating findings: success rate in authorised tailgating tests, trending down.
Alarm response: median time from door-forced alarm to acknowledgement.

Framework mapping

Area	ISO/IEC 27001:2022 Annex A	NIST SP 800-53 Rev 5	NIST CSF 2.0
Perimeters and entry	A.7.1 Physical security perimeters, A.7.2 Physical entry, A.7.3 Securing offices, rooms and facilities	PE-2 Physical Access Authorizations, PE-3 Physical Access Control, PE-8 Visitor Access Records	PR.AA-06
Monitoring	A.7.4 Physical security monitoring	PE-6 Monitoring Physical Access	DE.CM-02
Environmental threats and utilities	A.7.5 Protecting against physical and environmental threats, A.7.11 Supporting utilities	PE-11 Emergency Power, PE-13 Fire Protection, PE-14 Environmental Controls, PE-15 Water Damage Protection	PR.IR-02
Secure areas and desks	A.7.6 Working in secure areas, A.7.7 Clear desk and clear screen	PE-5 Access Control for Output Devices	PR.AA-06
Equipment, cabling and media	A.7.8 Equipment siting and protection, A.7.9 Security of assets off-premises, A.7.10 Storage media, A.7.12 Cabling security, A.7.13 Equipment maintenance, A.7.14 Secure disposal or re-use of equipment	PE-4 Access Control for Transmission, PE-9 Power Equipment and Cabling, PE-16 Delivery and Removal, PE-18 Location of System Components	PR.IR-02
Security systems as IT assets	A.8.20 Networks security, A.8.8 Management of technical vulnerabilities	CM-8 System Component Inventory, SC-7 Boundary Protection	ID.AM-01

See the ISO 27002 Controls Guide for implementation guidance on the Annex A controls.

Common failure patterns

Access control left to facilities alone: the head-end server runs an unpatched operating system on the flat corporate network, with an installer's default password.
Leaver badges still work: HR offboarding disables the directory account but nobody tells the badge system, especially for contractors and agency staff.
Legacy cards in high-security areas: cloneable proximity cards protect the data hall because the upgrade was never prioritised.
Cameras nobody watches or can search: footage overwritten before an incident is reported, or retained indefinitely because the NVR default was never changed.
Unlocked comms rooms and live ports: network cabinets in shared corridors and active ports in meeting rooms give an easy path for a hardware addition.
Tailgating accepted as politeness: staff hold doors for anyone carrying a box, and nobody tests it.

Practitioner checklist

Run a joint physical and cyber risk assessment for every site and record it in one risk register.
Define zones with authentication factors (one, two or three) and map every door to a zone.
Inventory all controllers, readers, cameras, NVRs and alarm panels with firmware versions and owners.
Segment physical security systems, remove internet exposure and prioritise KEV-listed devices for patching or replacement.
Change all default device passwords and vault the service account and integration credentials.
Plan migration from proximity cards and Wiegand to cryptographic credentials and OSDP Secure Channel, high-security zones first.
Drive badge provisioning and removal from the HR record and report orphaned badges weekly.
Complete a DPIA, signage audit and explicit retention setting for every CCTV estate.
Send badge and alarm events to the SIEM and build at least one correlation with logon data.
Commission authorised physical penetration and tailgating tests annually.

Physical Security Guide for Security Teams: Sites, Access Control and Convergence with Cyber