Description

This curriculum spans the equivalent depth and breadth of a multi-workshop program, addressing the integration of physical security into an ISO 27001-certified ISMS through detailed control implementation, cross-functional coordination, and audit-driven refinement across real-world operational environments.

Module 1: Aligning Physical Security with ISO 27001 Context and Scope

Determine whether shared office spaces or third-party data centers fall within the ISMS scope based on asset residency and control boundaries.
Document physical locations housing critical information assets, including backup storage sites and offsite print rooms.
Define exclusion justifications for remote workforces in the Statement of Applicability, specifying compensating controls.
Map physical access points (elevators, server room doors, parking garages) to asset sensitivity zones.
Engage facilities management in scope definition to capture non-IT physical infrastructure dependencies.
Assess jurisdictional variations in physical security regulations when the ISMS spans multiple countries.
Decide whether temporary construction zones near data centers require inclusion in access control policies.
Integrate physical security scope decisions into risk assessment inputs for A.11.1.2.

Module 2: Physical Controls in the Risk Assessment Process

Select threat scenarios involving forced entry, tailgating, or insider sabotage for inclusion in the risk register.
Assign realistic likelihood values to physical threats based on local crime statistics or past incidents.
Quantify impact of unauthorized access to server rooms in terms of data breach severity and recovery cost.
Justify control selection for outdoor backup generators using environmental threat modeling.
Document residual risks related to 24/7 facility access when security staffing is limited to business hours.
Validate physical control effectiveness assumptions with on-site observations, not just policy reviews.
Include physical destruction risks (e.g., fire, flooding) in asset vulnerability assessments for offsite archives.
Coordinate with fire safety officers to align evacuation procedures with data protection requirements.

Module 3: Securing Physical Perimeters and Entry Points

Specify minimum lock grades (e.g., ANSI Grade 1) for exterior doors based on asset classification levels.
Implement layered access zones using mantraps or airlock systems for data center entry.
Integrate visitor management systems with real-time badge printing and escort tracking.
Configure turnstiles to prevent tailgating while allowing emergency egress compliance.
Designate secure delivery areas for media and equipment to prevent unauthorized internal access.
Select vandal-resistant materials for exterior access control hardware in high-risk locations.
Enforce time-based access rules for contractors, automatically deactivating after project end dates.
Conduct penetration testing of perimeter controls using social engineering tactics.

Module 4: Data Center Physical Protection Strategies

Position CCTV cameras to eliminate blind spots around server racks and entry corridors.
Implement dual-person access rules for critical infrastructure areas with logging requirements.
Install environmental monitoring sensors (temperature, humidity, water) with automated alerts.
Design cable management systems to prevent accidental disconnections and tampering.
Specify electromagnetic shielding requirements for rooms processing highly sensitive data.
Enforce strict control over removable media entry and exit using locked transfer cabinets.
Validate raised floor load ratings to support high-density server installations safely.
Coordinate maintenance windows with security teams to manage temporary access exceptions.

Module 5: Device and Equipment Security

Apply cable locks to portable devices in shared workspaces based on device encryption status.

Define secure storage procedures for laptops overnight, including lockable cabinets or rooms.

Implement asset tagging and periodic physical audits for all mobile and portable equipment.

Enforce screen privacy filters in open-plan offices handling confidential information.

Establish decommissioning workflows that include physical destruction of hard drives on-site.

Restrict USB port usage via group policy, allowing exceptions only for encrypted drives.

Designate secure areas for printer and copier placement to prevent unauthorized document access.

Monitor printer logs for anomalies indicating potential data exfiltration attempts.

Module 6: Secure Handling of Physical Media

Specify encryption requirements for backup tapes transported between sites.
Define chain-of-custody procedures for offsite media storage providers with audit rights.
Implement locked mailrooms with access logs for sensitive physical correspondence.
Select fire-rated safes for storing cryptographic keys or system backups on-premises.
Establish media destruction schedules aligned with data retention policies.
Verify third-party shredding vendors with on-site witnessing of destruction processes.
Control access to microfiche or legacy media archives using role-based permissions.
Track physical media movements using barcode or RFID systems integrated into asset databases.

Module 7: Physical Security Monitoring and Detection

Configure motion detectors in server rooms to avoid false alarms from HVAC systems.
Set escalation protocols for alarm events during non-business hours with duty officer response.
Integrate access control systems with SIEM tools to correlate badge swipes with logins.
Define retention periods for CCTV footage based on incident investigation needs and privacy laws.
Conduct regular testing of intrusion detection sensors with documented results.
Restrict access to surveillance footage to authorized security personnel only.
Deploy glass-break sensors on windows adjacent to high-value equipment areas.
Validate fail-safe versus fail-secure configurations for door locks during power outages.

Module 8: Supporting Utilities and Environmental Controls

Design dual power feeds with automatic transfer switches for critical facility operations.
Specify UPS runtime requirements based on generator start-up and failover testing.
Implement water detection sensors under raised floors and near HVAC units.
Define maintenance schedules for fire suppression systems, including clean agent inspections.
Ensure emergency lighting covers all egress paths and critical control panels.
Validate HVAC redundancy to maintain temperature within equipment tolerances.
Coordinate utility shutoff procedures with local emergency responders.
Monitor fuel levels for backup generators with automated replenishment alerts.

Module 9: Incident Response and Physical Recovery

Integrate physical security breaches into the incident response plan with defined roles.
Conduct tabletop exercises simulating theft of backup media or unauthorized data center access.
Preserve CCTV footage and access logs immediately following a security event.
Establish coordination protocols with law enforcement for on-site investigations.
Define criteria for declaring a physical security incident versus a policy violation.
Implement post-incident access revalidation for affected zones.
Update physical controls based on root cause analysis of breach events.
Rehearse evacuation drills that include secure shutdown of critical systems.

Module 10: Auditing and Continuous Improvement of Physical Controls

Conduct unannounced physical access control audits using authorized social engineering attempts.
Verify that access rights reviews include physical access systems, not just logical access.
Compare access logs against active employee and contractor HR records quarterly.
Assess effectiveness of physical controls during internal audit walkthroughs.
Track false positive rates in intrusion detection systems to optimize sensitivity.
Review visitor log completeness and escort compliance during compliance checks.
Update physical security policies in response to control failures or audit findings.
Measure control maturity using ISO 27001 Annex A control objectives as benchmarks.