Physical Security Site Assessment Checklist

Most physical security gaps are only found when someone walks the site the way an intruder would, from the car park to the comms room, and tries every door on the way. This template is a site assessment checklist for offices, branches and small technical sites: perimeter, entry points, badges and access control, CCTV and alarms, visitors and deliveries, and the rooms that hold network and server equipment. It is built around the Deter, Detect, Delay and respond model used in UK protective security guidance and maps each section to NIST SP 800-53 PE controls and ISO/IEC 27001:2022 Annex A theme 7. It is for security, facilities and IT teams doing an annual review, a new site sign-off or a post-incident check. For the wider programme, read the Physical Security Guide for Security Teams first; this page is the walk-round form.

How to use this template

Replace text in square brackets, such as [Organisation], [Site name] and [Facilities manager], with your own terms.
Copy each checklist table into your tracker and add a Result column: Pass, Fail, Partial or Not applicable, with a photo or note as evidence for every Fail.
Assess in three passes: outside in (perimeter to building shell), during working hours (people and process) and out of hours (alarms, lighting, locked state). Many failures only show in one of them.
"Test" means try it: pull the door, present a revoked badge, ask reception for access without an appointment. A control is not passed because a policy says it exists.
Get written authorisation from [site owner] before any test that involves social engineering, tailgating or alarm activation, and tell reception and the alarm receiving centre where needed. Covert testing belongs in a scoped engagement; see the Social Engineering and Physical Penetration Testing Guide.
Rate each finding with your risk method (section 9) and record the owner and due date before you leave the site.

1. Purpose

This checklist provides a repeatable method for assessing the physical protection of [Site name] against unauthorised entry, theft, tampering with equipment and harm to people. It supports the physical access and monitoring requirements of [Physical and Environmental Security Policy] and gives evidence for audits against NIST SP 800-53 PE controls, NIST CSF 2.0 PR.AA-06 and DE.CM-02, and ISO/IEC 27001:2022 Annex A controls 7.1 to 7.14.

2. Scope

All [Organisation] owned or leased sites, including shared office floors, branches, warehouses, and comms or server rooms at those sites.
Third-party data centres and colocation are assessed through the provider's assurance reports and a site visit using section 7 only. See the Data Centre Security Guide.
Home workers are out of scope; see the Remote Work Security Checklist.

3. Roles and responsibilities

[Head of Security]: owns the checklist, approves the assessment schedule and accepts residual risks above [threshold].
Assessor: completes the walk-round, collects evidence and drafts findings. Should not be the person who runs the site day to day.
[Facilities manager]: provides drawings, alarm and maintenance records, and owns building fabric fixes.
[IT or network team]: owns comms rooms, access control and CCTV servers, and their network segments.
[Data Protection Officer]: reviews CCTV and visitor record findings that affect personal data.

4. Before the visit

ID	Check	Evidence to request
PR-1	Site risk profile agreed: what is protected (people, cash, stock, network core, records) and the realistic threats (theft, protest, insider, vehicle, opportunist).	Previous assessment, incident log for [12 months], threat briefing.
PR-2	Floor plans with doors, readers, cameras, alarm zones and comms rooms marked.	Current drawings, access control door list, camera schedule.
PR-3	Access control export: active badges, badge holders who have left, access groups for restricted areas.	Export from [PACS], HR leaver list for [90 days].
PR-4	Alarm and CCTV maintenance records, alarm receiving centre details and response arrangements.	Service reports, contract, police response reference if applicable.
PR-5	CCTV data protection paperwork.	DPIA, retention setting, signage locations, access log for footage.

5. Perimeter and grounds (Deter, Detect)

ID	Check	How to test
PE-1	The boundary between public and private space is clear and signed.	Walk the boundary; note where a passer-by could reasonably claim they did not know they were on private land.
PE-2	Fences, gates and walls are intact, with no climbing aids (bins, pallets, vehicles, trees) against them.	Full perimeter walk; photograph gaps and climbing aids.
PE-3	Vehicle gates and barriers close behind each vehicle and cannot be followed through.	Watch [10] entries at a busy time.
PE-4	External lighting covers entrances, car parks and blind corners, and works on its timer or sensor.	Out of hours walk; note dark spots and failed lamps.
PE-5	Ground floor windows, roof hatches, fire escapes and plant access are secured and alarmed where needed.	Check from outside and inside; try fire exit doors from outside.
PE-6	Waste and recycling areas do not hold readable documents or old media.	Inspect bins and confidential waste consoles.
PE-7	Vehicle approach risk is understood for crowded entrances; hostile vehicle mitigation advice taken where the threat warrants it.	Review stand-off and any advice from a Counter Terrorism Security Advisor.

6. Building entry, badges and visitors (Delay, Detect)

ID	Check	How to test
EN-1	Entry points are kept to the minimum needed, and every external door is either controlled or alarmed.	Count doors on the plan against doors found; list any uncontrolled.
EN-2	Doors close and latch on their own; none are wedged, taped or propped.	Try each controlled door after it closes; check for door-held-open alarms in [PACS].
EN-3	Tailgating is prevented or challenged: speed gates, turnstiles, or staff who challenge.	Authorised tailgating attempt at [peak time]; record whether anyone challenged.
EN-4	Badges of leavers and lost cards are disabled promptly.	Match PR-3 export against HR leavers; present a known revoked test card at a reader.
EN-5	Badge technology resists simple cloning; legacy low-frequency proximity cards are on a replacement plan.	Ask [PACS] owner for card type and reader protocol; note any 125 kHz cards.
EN-6	Badges are worn visibly and do not show the site address or access level in a way useful to a finder.	Observe; inspect a sample badge.
EN-7	Visitors are pre-registered, sign in, show ID where required, get a distinct badge and are escorted in non-public areas (NIST PE-8).	Arrive unannounced and ask for a named employee; note what reception checks.
EN-8	Visitor records are kept for [period], held securely and not visible to the next visitor.	Inspect the sign-in book or kiosk screen.
EN-9	Contractors and cleaners have time-limited access to only the areas they work in.	Review access groups for contractor badges.
EN-10	Deliveries and mail are received in a controlled area and not left in open reception (NIST PE-16).	Observe a delivery; check where parcels wait.

Access control systems are themselves networked systems with service accounts, default passwords and integrations. Check them with the Physical Access Control Systems Security Guide.

7. Comms rooms, server rooms and equipment

ID	Check	How to test
CR-1	Comms and server rooms are locked, on a separate access group with a short, reviewed member list (NIST PE-2, PE-3).	Compare the access group against the list of people who need it; try the door.
CR-2	Access to the room is logged and the log is reviewed (NIST PE-6).	Pull [30 days] of entries; ask who reviews them.
CR-3	Rooms are not shared with storage, cleaning supplies or another tenant's equipment.	Inspect.
CR-4	Racks are locked and keys are controlled; no unknown devices are plugged into switches or patch panels (ATT&CK T1200 Hardware Additions).	Check rack doors; compare visible devices with the asset list.
CR-5	Network ports in public areas (reception, meeting rooms) are disabled or protected by network access control.	Plug in an approved test laptop; note whether it gets a production address.
CR-6	Power, cooling and fire suppression are suitable and maintained: UPS tested, temperature monitored with alerts, extinguishers or suppression in date (NIST PE-11, PE-13, PE-14).	Check service labels and alert settings.
CR-7	Cabling is protected from tampering and accidental damage where it runs through shared areas (NIST PE-9).	Inspect risers, ceiling voids and floor boxes where accessible.
CR-8	Spare and retired equipment and storage media are locked away and disposed of through [approved disposal process].	Inspect store rooms; check the disposal record for a sample asset.

8. CCTV, alarms and monitoring (Detect, respond)

ID	Check	How to test
CV-1	Cameras cover entrances, car park, reception and comms room doors, and give usable images day and night.	Review live and recorded views for each camera on the schedule.
CV-2	Someone watches or reviews footage and alerts; recording is not the only use.	Ask who responds to a camera fault or alarm, and how quickly.
CV-3	A DPIA exists, signs name the operator, purpose and a contact and sit before the monitored area, audio recording is off unless justified, and cameras avoid private areas and neighbouring property.	Compare against the ICO surveillance guidance.
CV-4	Retention is set to the shortest period that serves the purpose, and is checked.	Find the oldest footage on the recorder and compare with the stated period.
CV-5	Recorders and video management servers are in a locked room, on a segmented network, with no default passwords and patched firmware.	Ask [IT]; review the network diagram.
CV-6	The intruder alarm is set out of hours, zones cover all entry points, and it signals to a monitored receiving centre with a defined response.	Review set and unset logs for [30 days]; confirm keyholder list is current.
CV-7	Access control alarms (forced door, door held open) reach someone who acts on them.	Hold a door open during the visit and confirm the alarm was seen.

9. People, process and rating findings

Clear desk and screen: walk desks and meeting rooms after hours for passwords on notes, unlocked laptops and printed sensitive data (ISO/IEC 27001:2022 A.7.7).
Reporting: ask three staff how they would report a stranger without a badge. They should know and believe the report will be taken seriously.
Keys and codes: check who holds master keys and when door codes were last changed.
Emergency procedures: confirm fire exits are clear, evacuation and lockdown plans exist, and staff know them.
Rating: rate each Fail by likelihood and impact using [risk method]. Treat a route that gives an outsider unescorted access to a comms room, or a working badge for a leaver, as high by default.

Checklist section	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A	NIST CSF 2.0
5 Perimeter	PE-3 Physical Access Control	7.1 Physical security perimeters	PR.AA-06
6 Entry, badges, visitors	PE-2, PE-3, PE-8 Visitor Access Records, PE-16 Delivery and Removal	7.2 Physical entry, 7.3 Securing offices, rooms and facilities	PR.AA-06
7 Comms rooms	PE-9, PE-11, PE-13, PE-14, PE-18 Location of System Components	7.8 Equipment siting and protection, 7.11 Supporting utilities, 7.12 Cabling security, 7.14 Secure disposal or re-use of equipment	PR.AA-06
8 CCTV and alarms	PE-6 Monitoring Physical Access	7.4 Physical security monitoring	DE.CM-02
9 People and process	PE-20 Asset Monitoring and Tracking (where used)	7.7 Clear desk and clear screen	PR.AA-06

10. Reporting and review

Issue the report within [10 working days]: summary, rated findings with photos, owners and due dates.
Track findings in [risk register or ticketing system]. High findings get an interim measure within [7 days], such as a guard post, a locked door or a disabled badge group.
Reassess each site every [12 months], after a significant incident, a move or a refit, and after any change to the access control or CCTV system.
This checklist is reviewed by [Head of Security] every [12 months].

Standards and references

Implementation guidance

Pilot on one site: run the full checklist at your head office, time each section and drop or add checks that do not fit your estate.
Tier your sites: a full assessment for head office, data rooms and high-value sites; a shortened version (sections 6, 7 and 8) for small branches.
Fix identity first: leaver badges and over-broad comms room access groups are the quickest, cheapest findings to close. Tie badge revocation to the HR leaver event; see the Joiner-Mover-Leaver Guide.
Measure: track percentage of sites assessed on schedule, open high findings older than their due date, leaver badges still active after [24 hours], comms room access group size per site, and tailgating test success rate.
Join it up with cyber: send CCTV, PACS and alarm system findings to the IT risk register too, because these systems sit on the network. See the Physical and cyber security convergence.

Small organisations in a shared building should focus on their own floor door, visitor handling, the comms cupboard and leaver badges, and ask the landlord for evidence on the perimeter and building alarm. Large estates should run the checklist in a form tool so results roll up by region and finding type.

This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Physical Security Guide for Security Teams · Physical and Environmental Security Policy Template · Data Centre Security Guide · Physical Access Control Systems Security Guide

Physical Security Site Assessment Checklist: Walking a Site Like an Intruder Would