When an unauthorised person gets into an office, data centre or plant room, the physical incident usually ends within minutes, but the cyber incident it may have started can run for months. A tailgater who leaves after ten minutes may have photographed screens, taken a laptop, plugged a device into a network port or a server, or simply tested how far they could get before a later visit. This playbook template gives [Organisation] one response for physical intrusions: tailgating and unauthorised entry, rogue devices found on site, stolen equipment, and misuse of facility access by insiders or former staff. It joins up facilities, security operations, IT, HR and legal, names decision points, and lists the evidence to keep. Personal safety always comes first: staff are never expected to confront an intruder. Prevention and site design are covered in the Physical Security Guide for Security Teams; this page is the response runbook. Replace every [Organisation] placeholder before use.
How to use this template
- Adopt it jointly with the facilities or corporate security team and the cyber incident response team. Physical intrusions fall between the two, so agree in advance who leads which part. See the Physical and cyber security convergence guide.
- Use the four scenario tracks in section 1.2. Each section marks steps that apply only to one track.
- Fill in site specifics: guard contact numbers, the access control system administrator, CCTV retention periods, which network ports are live, and local police non-emergency and emergency contacts.
- Keep decision points explicit. Each "Decision" line names who decides and on what evidence.
- Exercise it with a tabletop at least yearly, and use authorised physical penetration tests to test the reporting chain. See the Social Engineering and Physical Penetration Testing Guide.
1. Scope and triggers
1.1 This playbook applies to any [Organisation] site, including offices, data centres, network and comms rooms, warehouses, plant rooms and shared or co-working spaces where [Organisation] equipment is kept.
1.2 Scenario tracks:
| Track | Examples | Main cyber concern | ATT&CK |
|---|---|---|---|
| T: Tailgating and unauthorised entry | Person follows staff through a door, uses a borrowed or cloned badge, poses as a contractor or delivery driver | What they touched, saw or took; whether they left something behind | T1200 Hardware Additions |
| R: Rogue device found | Unknown small computer behind a desk, wireless access point in a meeting room, USB device in a port or left in a car park, keystroke logger on a cable | Network or host access, data capture, malware delivery | T1200 Hardware Additions; T1091 Replication Through Removable Media |
| S: Stolen or missing equipment | Laptop, phone, removable media, server drive, backup tape, paper files | Data on the device, cached credentials and sessions | T1052.001 Exfiltration over USB (where data was copied before removal) |
| I: Insider facility access misuse | Leaver whose badge still works, staff entering areas outside their role or hours, contractor lending a badge | Data theft, sabotage, access left active after leaving | T1078 Valid Accounts (for digital access the same person still holds) |
1.3 Triggers: a staff report of a stranger or tailgating; a door held or forced alarm; an access control event such as a badge used at two sites at once, outside permitted hours, or after its holder left [Organisation]; an anti-passback violation; a guard patrol finding; an unknown device on the network or a new wireless network; a missing asset report; a visitor not signed out; a physical penetration test that was not announced to the incident team.
1.4 Related playbooks: an unknown device detected only on the network follows the Rogue Device on Network Playbook; a confirmed insider taking data follows the Insider Data Theft Response Playbook; deliberate damage follows the Insider Sabotage Response Playbook.
2. Roles and contacts
| Role | Named lead | Responsibilities |
|---|---|---|
| Incident lead | [Name, phone] | Declares the incident, sets severity, owns decisions and the joint timeline |
| Site security lead or guard supervisor | [Name, 24-hour number] | Personal safety, searching the area, escorting, police liaison on site, CCTV preservation |
| Access control administrator | [Name] | Badge suspension, door event exports, anti-passback and zone changes |
| SOC analyst | [Rota] | Network and endpoint review for the affected area and time window |
| IT and network engineer | [Name] | Port and wireless checks, device isolation, remote lock and wipe |
| Digital forensics | [Internal or retained provider] | Collection and examination of rogue devices and affected hosts |
| HR | [Name] | Staff involvement, leaver records, interviews, disciplinary process |
| Legal and privacy | [Data protection officer, counsel] | Notification, police referral, CCTV disclosure and privacy obligations |
2.1 Staff instruction for every site: do not challenge anyone who seems hostile; note a description, direction and time; call [site security number]; in an emergency call [999 or 911]. The UK National Protective Security Authority's See, Check and Notify (SCaN) approach and CISA's "If You See Something, Say Something" campaign both build on staff noticing and reporting rather than intervening.
3. Detection and triage
3.1 Make the area safe first. The site security lead confirms whether the person is still on site and whether anyone is at risk. Police come before any IT action if there is a threat to people.
3.2 Preserve physical evidence immediately:
- CCTV: export footage for the whole visit, from approach to exit, before the system overwrites it ([retention] days). Record the export time, the system clock offset and who exported it.
- Access control logs: door events, badge reads, forced and held door alarms and visitor records for the time window. See the Physical Access Control Systems Security Guide.
- Witness notes: written by each witness separately, as soon as possible.
- The scene: photograph desks, ports, racks and devices before anyone touches them.
3.3 Track R, handling a rogue device: photograph it in place, including cables and the port it uses. Do not plug it into any computer. Record the switch port or wireless details. Decision (incident lead with forensics): leave connected and monitored for a short time to learn what it talks to, or disconnect at the switch port now. Disconnect now if it sits in a sensitive area or you cannot monitor it. Bag, label and seal it with a chain of custody form when removed.
3.4 Map what the intruder could reach. List the rooms entered, unlocked workstations, network ports, printers, comms cabinets and documents in those rooms. The SOC reviews for the same window: new devices on the network (DHCP leases, switch port changes, network access control rejections), new wireless networks, USB insertions on endpoints, and sign-ins at workstations in the area.
3.5 Track S, scope the loss: device type, owner, encryption status (confirm from the management console, not from the user), when it was last checked in, whether credentials or sessions were cached, and what data it held.
3.6 Track I, confirm whose badge was used and whether that person is a current employee, a leaver or a contractor, and whether their digital access matches their facility access.
3.7 Rate severity.
| Severity | Criteria (example, adapt) |
|---|---|
| Critical | Entry to a data centre, comms room or secure area; rogue device connected to the internal network; stolen unencrypted device holding personal or sensitive data |
| High | Intruder reached open office areas with unlocked workstations or documents; stolen encrypted device with privileged access |
| Medium | Intruder stopped in a reception or common area; stolen encrypted standard device |
| Low | Tailgating by a confirmed employee or visitor with legitimate business, logged for awareness |
4. Containment
4.1 Physical containment: search the areas the intruder reached for left devices; lock or guard affected rooms; suspend any badge used in the incident; change door codes and recover keys for any key that may have been copied; increase guard presence at the entry point used.
4.2 Network containment (Tracks T and R): disable unused live ports in the affected area; isolate the switch port a rogue device used; check that network access control blocked it, and if not, find out why. Remove any unknown wireless network and check the wired network for a bridge to it.
4.3 Endpoint containment: isolate any workstation the intruder may have used, or any host a rogue USB device was attached to, through the endpoint detection platform; preserve it for forensics before reimaging.
4.4 Track S: issue a remote lock and, once forensics agree, a remote wipe through device management; revoke the device's certificates and the user's sessions and refresh tokens; reset passwords and secrets cached on the device, including VPN, Wi-Fi and SSH keys. A stolen laptop is also a credential incident. See the Account Takeover Response Playbook.
4.5 Track I: suspend facility and digital access together. HR and legal decide on interview timing so evidence is not lost by tipping off the person.
4.6 Decision (incident lead with legal): report to the police. Report when there was theft, damage, a threat to people, or a device was planted. Agree with the police how forensic evidence will be shared before handing anything over.
5. Eradication
5.1 Remove every device left by the intruder after forensic collection, and sweep comparable areas at other sites if the method could be repeated.
5.2 Reimage workstations or servers the intruder used or where a rogue device was attached, and rotate any credentials entered on them since the intrusion.
5.3 Fix the access control fault that allowed entry: disable leavers' badges that remained active, repair doors that do not close, add anti-passback or turnstiles where tailgating is common. See the Tailgating and Piggybacking Guide.
5.4 Reconcile badge holders with the HR system, and digital accounts with badge holders, so access ends together when people leave.
6. Recovery
6.1 Return affected rooms to normal use once searched and cleared. Keep extra patrols or entry checks for [14] days.
6.2 Re-issue equipment to users of stolen devices with fresh credentials and enrolment.
6.3 Monitor for follow-on activity: sign-ins with credentials from the area, network devices reappearing, or a second visit. Hostile reconnaissance, which NPSA describes as the information gathering phase by people with malicious intent, may come before a later attack.
7. Communication and notification
| Audience | Owner | When and what |
|---|---|---|
| Staff at the site | Site security lead | Same day: what happened at a level that does not compromise the investigation, how to report, reminder not to hold doors for people without badges |
| Executive sponsor | Incident lead | Critical and High at declaration |
| Police | Site security lead with legal | Per decision 4.6; record the crime reference |
| Data protection regulator | Privacy lead | If personal data was lost or accessed and the breach is notifiable: under GDPR and UK GDPR Article 33, within 72 hours of becoming aware. A stolen device with strong encryption and an uncompromised key often lowers the risk assessment; record the reasoning |
| Landlord, building management or co-located tenants | Facilities | When the entry point is shared or the intruder may have reached other tenants |
| Customers | Legal and account owners | If their data or equipment hosted at the site was affected, or contracts require it |
7.1 CCTV images of identifiable people are personal data; share them only with the police or as legal advises.
8. Post-incident review
8.1 Within [10] working days, record the joint physical and digital timeline: entry, movements, devices touched or left, exit, detection, containment.
8.2 Root cause questions: How did they get in? Did staff report it, and how fast? Was the badge of a leaver still active? Were live network ports unprotected by network access control? Were workstations left unlocked? Were stolen devices encrypted and managed?
8.3 Metrics to track:
- Time to report: intrusion to first report.
- Time to suspend: leaver departure to badge deactivation, and incident to badge suspension.
- Badge and account reconciliation gaps found per quarter.
- Share of live network ports covered by network access control.
- Device encryption coverage confirmed by management console.
- Tailgating test pass rate in authorised physical tests.
Implementation guidance
- Link the logs: send access control and CCTV system events to the SIEM so badge anomalies can be correlated with sign-ins and network events. See the IP Camera and CCTV Security Guide.
- Prepare kits: evidence bags, chain of custody forms, a camera and labelled containers at each site; train guards on not powering on or plugging in found devices.
- Join up leavers: one leaver process ends badge, building keys and digital access on the same day.
- Write the policy first: the Physical and Environmental Security Policy Template sets the rules this playbook enforces.
| Playbook element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Badge suspension and entry control | PR.AA-06 | PE-3 Physical Access Control |
| CCTV and access log review | DE.CM-03 | PE-6 Monitoring Physical Access |
| Visitor records | PR.AA-06 | PE-8 Visitor Access Records |
| Response and reporting | RS.MI-01, RS.CO-02 | IR-4 Incident Handling, IR-6 Incident Reporting |
Standards and references
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE family)
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: T1200 Hardware Additions
- CISA: Physical Security
- NPSA: Hostile reconnaissance
- NIST: SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management
Related NHI Mgmt Group resources: Physical Security Guide for Security Teams · Rogue Device on Network Playbook · Physical Security Site Assessment Checklist · Insider Threat Programme Guide