Physical security involves security measures that deny unauthorized access to facilities and equipment. It also entails protecting personnel from harm and property from damage.

In cybersecurity, we focus on protecting digital assets. These digital assets however are all stored on physical devices. Without physically securing those devices then true cybersecurity can not be achieved.

In the defense-in-depth strategy, physical security measures are your first line of defense. They keep unauthorized persons from walking into your facility and stealing or damaging your systems. Physical security measures including fences, locked doors, surveillance cameras, and identity badges.

I will use some of the physical security requirements from the U.S. Department of Defense’s new cybersecurity maturity model certification (CMMC) to demonstrate the physical security controls every organization should implement.

• Limit who can enter your facility (e.g, using a key card entry system)
• Escort guests while they are at your facility (e.g., sign them in at the front desk, give them a visitor badge, and assign an escort)
• Record who enters and exits your facility (e.g., use a key card entry system with logging capabilities and have visitors sign-in on a sign-in sheet)
• Monitor your facility (e.g, using surveillance cameras) and protect support infrastructure (e.g., fuze box and ethernet cables)

The CMMC controls I referenced above were: PE.1.131, PE.1.132, PE.1.133, PE.1.134, and PE.2.135.