Physical and Cyber Security Convergence Operating Model

Most organisations still run physical security and cyber security as separate teams with separate risk registers, separate monitoring and separate incident processes, even though attackers and insiders move freely between the two. A door controller is a networked computer and a badge is an identity. This guide is about the operating model: how to govern a converged function, merge the two risk processes, run joint detection use cases, write joint playbooks and measure whether it works. For site controls, badge technology and CCTV, see the Physical Security Guide for Security Teams; this page does not repeat them.

Key takeaways

Convergence is collaboration, not a reorganisation. CISA defines it as formal collaboration between previously disjointed security functions; a shared governance body and written agreements deliver most of the value without changing reporting lines.
Merge the risk process first. The Interagency Security Committee (ISC) identifies converging the physical risk management process and the NIST Risk Management Framework as potentially the most important step.
Treat building systems as IT assets with owners. Access control, video, intrusion detection, HVAC and lift controllers need inventory, patching, segmentation and managed credentials like any server.
Joint detection needs joined data. Badge events, HR status and directory sign-ins correlated in one place catch impossible presence, orphaned badges and insider patterns that neither team sees alone.
Leavers are the classic gap. A leaver process that disables the badge and the user account but forgets keys, tokens and service credentials leaves the door open from the network side.

Why the split fails

CISA's convergence guide lists the cross-domain scenarios that siloed teams miss: an access control gap that lets someone plug a USB or other removable device into a system, an HVAC system overridden remotely until server rooms overheat, a drone used to reach an unsecured wireless network, and attacks on connected medical devices. It also notes that physical and cyber teams run as separate entities leave leaders without a full view of threats.

Scenario	What the physical team sees	What the cyber team sees	What only a joint view reveals
Rogue device left in a meeting room (ATT&CK T1200 Hardware Additions)	Visitor signed in, escorted part of the time	New MAC address on a user VLAN, no NAC posture	Device appeared in the room the visitor used, during the visit window
Malware introduced on removable media (T1091)	Contractor badge into the plant room	EDR alert on an engineering workstation	Same person, same room, same hour
Credential sharing or account misuse	Badge in Manchester at 09:02	Interactive VPN sign-in from abroad at 09:05	Impossible presence: one of the two is not the employee
Departing insider collecting data	Out-of-hours visits to the records room	Bulk downloads from a file share	Pattern matches a resignation notice HR already holds
Building system compromise	Doors or cameras offline	Controller talking to an unknown internet address	A physical outage with a network cause, needing both teams to recover

Choosing a governance model

The ISC best practice Security Convergence: Achieving Integrated Security (2022) describes three approaches that can be used alone or combined.

Approach	What it looks like	Best for	Trade-off
Governance	A formal council or committee with physical security, CIO, CISO, insider risk, legal, risk and health and safety members	Most organisations as the first step; federated or multi-site groups	Decisions can be slow; works only if the body owns a budget line or a risk register
Organisational	One integrated office or programme manager leads security across domains (the ISC cites NASA's integrated security programme manager, created in 2008)	Large or regulated estates, critical infrastructure	Restructuring cost and culture friction; risk of losing specialist depth
Procedural	Charters, memoranda of agreement or service agreements that fix who does what for each shared system	Organisations where facilities, IT and security sit in different directorates or companies (including landlords and outsourced guarding)	Agreements go stale unless reviewed; does not by itself create shared risk decisions

The ISC says an agreement for an electronic security system should cover cooperative work between physical security, IT, system owners and service providers; configuration management; an approved products list; the system security plan and operating procedures; and a service level agreement for availability and performance. Its example is a single charter under which the IT office managed access control hardware, software and firmware while the security office audited access. IT runs it, security audits it: a sensible default.

Small organisations: one person often holds both roles informally. Write a one-page agreement with the landlord or facilities provider covering leaver badge removal, who holds controller admin credentials, log access and how incidents are reported to you. Large organisations: start with the governance body, then move to an integrated office only where the risk register shows repeated cross-domain incidents.

Merging the risk process

Physical teams usually assess sites (threat, vulnerability, level of protection per facility) while cyber teams assess systems (categorisation, controls, authorisation). The ISC proposes a nine-step converged flow that joins the two; adapted for non-federal use it reads:

Rate each site's security level, using whatever site classification you already have.
Identify and categorise every information system at the site, including building systems, with a named owner.
Set a baseline level of protection from the site rating and the confidentiality, integrity and availability impact of the systems in it.
Assess risks to decide whether the baseline is enough or needs tailoring.
Decide the protection needed and whether an IT control can deliver part of it (for example network detection instead of an extra guard patrol).
Run the system-level risk assessment for the IT systems selected.
Where the needed protection cannot be reached, record the highest achievable level and the residual risk for acceptance.
Implement countermeasures and document how they are maintained.
Measure performance and repeat when a site or system changes.

The practical output is one risk register, scored on one scale, where a weak door and a weak firewall rule compete for the same budget. See the Risk Register Template. NIST CSF 2.0 GV.RM-03 (cyber risk included in enterprise risk management) is the outcome you are aiming for.

Building systems as a joint asset class

The ISC recommends an operational technology assessment, run by physical, cyber and information security specialists together, covering surveillance, safety management, lighting control, electronic physical access control, lifts and escalators, business and emergency communications, intrusion detection, building automation dashboards and consoles, HVAC and power management.

Ownership: every controller, video recorder and building management server has a named business owner (facilities) and a technical owner (IT or OT), recorded in the CMDB (CSF ID.AM-01, CIS Controls v8.1 Control 1).
Network: building systems sit on their own segment with documented flows to the head-end servers, and no direct internet access for controllers. See the Building Management System Security Guide.
Vulnerability management: vendor advisories for access control, camera and BMS products go into the same triage queue as IT advisories. See the ICS Advisory Triage and OT Vulnerability Management Guide.

Where identity fits

A badge is an identity record, and the access control system is an identity system that usually sits outside identity governance. Three identity links make convergence real:

One authoritative person record: provision badges from the same HR-driven joiner, mover and leaver events as directory accounts, so a leaver loses both on the same trigger. See the Joiner-Mover-Leaver Guide. NIST SP 800-53 PS-4 (personnel termination) and PE-2 (physical access authorisations) belong in the same procedure.
Machine identities in building systems: head-end servers use service accounts for directory sync, database access and integration with visitor and alarm systems; installers often leave shared admin logins on controllers. Inventory them, vault them and rotate them like any other non-human identity. See the Service Account Security Guide.
Credential strength by zone: NIST SP 800-116 Rev. 1 describes a risk-based choice of card authentication mechanisms for facility access. Align the strongest door credentials with the rooms that hold your most privileged systems.

The leaver gap is not only physical. In the Coupang signing key breach, the former engineer's staff account was disabled but a token signing key he had obtained was never revoked, and it was used months later. A converged leaver checklist covers badge, accounts, keys, tokens and shared credentials in one step.

Joint detection and operations

Few organisations need a merged operations centre. They need badge, alarm and video metadata in the SIEM and agreed hand-offs between the control room and the SOC.

Use case	Data sources	Logic	Owner of first response
Impossible presence	Access control events, VPN and identity provider sign-ins	Badge-in at a site and remote interactive sign-in for the same person within a short window	SOC, with a call to the site control room
Orphaned badge	Access control cardholder export, HR leavers, directory account state	Active badge with no active HR record or a disabled account	Facilities, reported to security governance
Out-of-pattern access to sensitive rooms	Access events for data centre, comms and records rooms	First access in 90 days, out of hours, or by someone on a watch list from insider risk	Insider risk team
Door forced or held with network change	Door alarms, switch port and NAC logs	Door alarm followed by a new device on a port in the same zone	Joint: guard attends, SOC isolates port
Building system tampering	Controller and head-end audit logs, firewall logs	Admin login from a new source, firmware change outside change window, controller beaconing out	SOC, with facilities for physical fallback

Run new rules in monitoring mode for four weeks and tune for shift workers, shared reception doors and staff who badge in and then use VPN from the office network. Agree a retention period for badge data with your data protection officer before you start: correlating presence with system activity is worker monitoring, and in the UK the ICO's monitoring workers guidance applies (it is under review following the Data (Use and Access) Act). Assess the processing with a DPIA, tell staff what is monitored and why, and keep the correlation to defined security purposes. NIST SP 800-53 PE-6 (monitoring physical access) and CSF DE.CM-02 (the physical environment is monitored) map here. See the Insider Threat Programme Guide for the governance around watch lists.

Joint incident playbooks

Write short playbooks for the incidents that cross the line, with the decision points named.

Lost or stolen device: facilities logs the report and checks CCTV for the last known location; IT revokes sessions, wipes or locks the device and checks for sign-ins after the loss time; security decides whether it is a reportable personal data breach.
Tailgating or unauthorised person seen: guard detains or escorts; SOC checks network ports and wireless in the areas visited; both preserve access logs and video for the same window. See the Tailgating and Piggybacking Guide.
Access control or camera system outage: facilities moves to manual procedures (guards, physical keys held under dual custody); SOC treats it as a possible compromise until the cause is known, and checks the head-end server for intrusion before restoring.
Insider case: HR, legal, insider risk and both security teams agree who may see what; evidence from badge, video and IT logs is preserved under one case reference.

Exercise these jointly once a year. See the Tabletop Exercise Guide.

Implementation roadmap

Assess (month 1-2): run a joint security assessment of one representative site (CISA suggests a third-party assessment if you cannot do it internally). List building systems, owners, credentials and network paths.
Govern (month 2-3): charter the convergence council, agree the shared risk scale and write the first service agreements for access control and video.
Join identity (month 3-6): connect HR leaver events to badge deactivation, reconcile the cardholder database against HR and the directory, and vault building system admin credentials.
Pilot detection (month 4-6): stream one site's access events to the SIEM in monitoring mode, tune two or three use cases, then turn on alerting. Roll back by disabling the rules, not the ingest.
Playbooks and training (month 6-9): publish joint playbooks, run a tabletop, and train both teams on shared terminology.
Scale and measure (month 9+): extend to remaining sites by risk, and report the metrics below to the council quarterly.

Measuring convergence

Orphaned badges: active badges with no matching active HR record, target zero at each monthly reconciliation.
Leaver closure time: median hours from HR leave date to badge, account and credential removal, measured together.
Building system coverage: percentage of controllers, recorders and BMS servers with an owner, a patch status and vaulted credentials.
Log coverage: percentage of sites whose access events reach the SIEM.
Joint incidents: number of incidents handled under a joint playbook and the time to hand-off between control room and SOC.

Framework mapping

Area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Roles and governance	GV.RR-02	PM-9 Risk Management Strategy	5.2 Information security roles and responsibilities
Single risk process	GV.RM-03	PM-9	Clause 6.1 risk assessment and treatment
Physical access and authorisations	PR.AA-06	PE-2, PE-3, PE-8	7.1 to 7.3 physical perimeters, entry and offices
Physical monitoring	DE.CM-02	PE-6, PE-20, CA-7	7.4 Physical security monitoring
Leavers	PR.AA-01	PS-4 Personnel Termination	6.5 Responsibilities after termination or change of employment
Insider risk and joint response	RS.MA-01	PM-12 Insider Threat Program, IR-4 Incident Handling	5.24 to 5.26 incident management

Common failure patterns

A committee with no teeth: the council meets but owns no budget or register, so physical and cyber spending decisions stay separate.
Building systems owned by nobody in IT: controllers run unpatched firmware with installer default logins because facilities assumed IT managed them and IT assumed the vendor did.
Leaver process split across teams: the badge is cancelled a week late, or the account is disabled but keys and service credentials remain, as in the Coupang case above.
Alert flood from naive correlation: impossible presence rules fire on every remote worker who badges in and uses VPN on site, and the SOC stops looking.
Monitoring without a privacy basis: badge and logon correlation launched without a DPIA or staff notice, and then challenged by staff representatives or a regulator.
Outages handled as facilities faults only: a failed access control server is rebuilt from backup without checking why it failed, restoring a compromised configuration.

Practitioner checklist

Charter a convergence council with physical security, IT, the CISO, insider risk, legal, risk and health and safety, and give it the shared risk register.
Inventory every building system with a business owner and a technical owner.
Put building systems on their own network segment and into the vulnerability triage queue.
Vault and rotate admin and service credentials on access control, video and BMS servers.
Drive badge issue and removal from the same HR events as directory accounts, and reconcile monthly.
Stream access control events to the SIEM and tune impossible presence and orphaned badge rules in monitoring mode first.
Complete a DPIA and staff notice before correlating badge and system activity.
Publish joint playbooks for lost devices, tailgating, building system outages and insider cases, and exercise them yearly.
Report orphaned badges, leaver closure time and building system coverage to the council every quarter.

Physical and cyber security convergence: an operating model for joint governance, detection and response