A financial services company has encrypted disks, redundant cloud-hosted databases and stringent logical access policies. Its regional office still stores backup hardware behind an unlocked maintenance door, shares one power feed with a cooling unit and provides contractors with unlogged building access. A virtual firewall cannot compensate for those physical failures. Security architecture extends to people, buildings, equipment handling and environmental conditions that determine whether information systems can be protected or restored.
The current CISSP outline includes physical site and facility security controls within Security Architecture and Engineering and touches physical safety during Security Operations. This article examines physical controls as parts of a service dependency model rather than a checklist of fences, locks and cameras.
Build a threat model for each site and function
A public lobby, server room, offsite backup store and colocation cage have different likely threats and business impacts. Identify theft, tampering, unauthorized maintenance, fire, water leaks, power loss, overheating and disruption caused by an insider or a visitor. Determine which systems are essential for local operation and which can be recreated elsewhere.
A realistic threat model also considers people. Emergency evacuation cannot be sacrificed to a security mechanism that traps occupants. Controls must work with fire safety and relevant building regulations rather than treating occupants as a secondary concern.
Layer perimeter, building and equipment access controls
Different zones should have different authorization and evidence requirements. A visitor may be permitted in reception but must not pass into a rack area using a staff member’s badge. Use relevant physical barriers, monitored entry, visitor logs, escort rules and periodic badge revocation. Identify who may grant exceptional access during a facility incident.
Dual-person procedures can be useful for highly sensitive storage or key material, but they also require practical staffing and emergency planning. A policy that nobody can operate during a night incident is not an effective control.
Design detection and response, not only denial
A door sensor or surveillance system should be connected to a responsible monitoring and response process. Recording video without retention policy, integrity safeguards or reviewed access may create a privacy risk while failing to detect an active intrusion. Choose placement and retention based on the actual threat, evidence requirements and local law.
Test a forced-open alarm during an authorized drill: who receives it, what evidence records the event and how is an appropriate response initiated? Security operations must route intrusion alarms to responders who can act and preserve evidence.
Evaluate power, cooling and fire as coupled dependencies
Redundant power feeds can share a single distribution panel, and an uninterrupted compute supply can still fail when cooling controls or fire-suppression systems are unavailable. Map upstream utility, fuel, maintenance staffing and physical access to the workloads they support. Treat life safety and applicable building codes as independent constraints: no availability target justifies bypassing a required fire or evacuation safeguard.
Two power supplies do not create resilience if they share one upstream breaker. Likewise, redundant cooling units may depend on one control system or water connection. Identify common-cause failures and design alternate feeds, monitoring and fail-safe shutdown when justified by business requirements. Recovery targets should include the time necessary to start or move the service.
Fire detection, suppression and human evacuation are distinct functions. Technology choice should consider occupied rooms, damage to equipment, local regulations and the consequences of accidental discharge. An engineering recommendation must work with facilities and safety specialists instead of assuming a single suppression method fits every building.
Include supply, repair and decommissioning paths
Contractors carrying replacement drives, cleaners with after-hours access, delivery personnel and disposal vendors can cross trust boundaries. Track equipment custody and authorize maintenance explicitly. A failed drive should not leave the company simply because it has been removed from service; determine destruction or return terms before replacement.
If a rack component contains keys or unencrypted caches, classify it accordingly. Asset ownership and chain of custody continue through transport and decommissioning.
Compare colocated, on-premises and cloud responsibilities
A cloud customer usually does not operate the provider’s physical doors or cooling, but still needs supplier assurance appropriate to the workload and shared-responsibility arrangement. On-premises and colocation arrangements may put different controls and emergency procedures under the customer’s authority. Request evidence that matches the responsibility boundary; do not imply that outsourcing physically transfers every regulatory or contractual duty.
For critical services, review site diversity and geographic correlation. Two facilities next to the same floodplain may provide less separation than a diagram suggests.
Test the physical failure as a business event
During an exercise, simulate loss of a shared utility dependency and measure what happens to building access, temperature alarms, surveillance retention and the protected business service. A locked server rack provides little security if a maintenance procedure bypasses sign-in logs during outages. Record both life-safety exceptions and emergency access controls so emergency response does not become unreviewed permanent privilege.
Rehearse an inaccessible building, failed upstream power path or lost backup media with authorized participants. Confirm whether monitoring still runs, necessary staff can enter safely, secure backups exist outside the affected site and customer operations can meet agreed recovery objectives. Record what was actually tested and which dependencies were only discussed.
Physical security succeeds when protection, life safety, detection, custody and restoration support one another. The CISSP decision is not ‘more locks’; it is a facility and information-risk design that can be operated honestly through everyday maintenance and extraordinary failure.