CISSP 10.3 - Implement & Manage Physical Security (Part 1 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series builds the outer defenses of a facility from the fence line inward, part of Domain 3. It walks through the boundary controls that discourage most trouble long before it reaches the front door — and why a thoughtfully designed perimeter means you defend the property line instead of the lobby.

Frequently Asked Questions

What role does signage play in physical security?

Signage sets expectations and quietly shapes behavior before anyone touches a lock. Signs mark areas as off-limits, announce that cameras are watching, point out entrances and exits, and post safety warnings, which deters petty wrongdoing and establishes a basis for holding rule-breakers accountable. Signage is not only physical — digital warning banners belong on local and remote connections too.

How do fences, gates, turnstiles, and person traps stop intruders?

They form a layered physical boundary, each piece tuned to a threat. A fence defines the line and its height signals its purpose, a gate is the controlled opening that must be as strong as the fence around it, a turnstile lets just one authenticated person through at a time, and a person trap holds someone between two doors until their identity is verified. Bollards stop vehicles from ramming an entrance, and barricades control the flow of people and cars.

What does lighting really accomplish?

Lighting discourages the casual intruder who would rather work in the dark, and it is the most commonly deployed perimeter control. On its own it is a weak deterrent, so pair it with cameras, guards, or sensors. Aim it carefully too — poorly placed lights create glare that blinds your own guards and cameras, so space the poles so the pools of light overlap with no dark gaps.

Why do guards and guard dogs still matter in an automated world?

A human can judge a situation in a way no sensor can, recognizing new attack patterns and making decisions on the spot. Guards should patrol frequently but at random times so an intruder cannot learn the schedule, though they can be unreliable, expensive, and vulnerable to social engineering. Guard dogs are an effective deterrent and detector but costly to house, feed, and insure, while robot sentries and drones can now patrol automatically.

How do you handle visitors once they are inside?

Control and track visitors from the moment they arrive, usually with an assigned escort who monitors their access and activity closely. Reception works as a choke point, segregated from secure areas behind locked doors and watched by cameras. Keep visitor logs, because those physical records give context to your digital logs and help confirm everyone got out safely in an emergency.

Reference: This article is based on concepts discussed in CISSP 10.3 - Implement & Manage Physical Security (Part 1 of 2).