Security Operations · Topic 9 of 9
Physical Security and Personnel Safety
Running perimeter and internal physical security controls, and protecting personnel through travel security, training, emergency plans and duress codes.
- 3 min
- Perimeter: fences, bollards, lighting, cameras, sensors, guards.
- Internal: vestibules, multifactor entry, escorts, alarms.
- Guards provide judgment; cameras verify alarms; sensors cover long perimeters.
What it is
Physical security in operations means running the controls that protect sites and equipment every day. Personnel safety means protecting staff wherever they work: on site, travelling or remote. People are the most important asset; their safety outranks everything else.
How it works
Perimeter controls
| Control | Purpose |
|---|---|
| Fencing and bollards | Deter and delay; bollards stop vehicles |
| Lighting | Deters and removes hiding places; uniform lighting is better than bright spots and dark patches |
| Cameras (CCTV) | Detect and record; linked to alarms for remote assessment |
| Intrusion detection sensors | Fence-mounted or perimeter sensors cover long or unstaffed boundaries economically |
| Guards | Use judgment, challenge strangers, respond |
| Dogs | Deter and detect, with handling and liability considerations |
Internal controls
Access control vestibules (mantraps), badge readers with PINs or biometrics for sensitive rooms, visitor logs and escorts, locks, alarms on doors, and clean desk policies. Guards are the only control that can apply judgment, so place them where people must be challenged.
Match the control to the gap. Long unstaffed fences need sensors; alarm verification needs cameras; busy entrances needing judgment need trained guards.
Managing physical security operations
Review access logs and camera footage, test alarms, maintain equipment, recover badges from leavers and audit who holds access to sensitive areas.
Personnel safety and security
| Area | Measures |
|---|---|
| Travel | Pre-travel briefings, travel-specific devices with minimal data, VPN use, awareness of local laws and threats |
| Security training and awareness | Recognizing tailgating, social engineering, workplace violence warning signs |
| Emergency management | Evacuation plans, shelter-in-place, drills, accounting for all staff |
| Duress | Duress codes or panic buttons that silently signal coercion |
| Remote and lone workers | Check-in procedures, secure home setups |
Life safety principles
- Exits must remain usable; security hardware must comply with life-safety codes.
- Doors on escape routes fail safe (unlock) in emergencies.
- During incidents and evacuations, people come before equipment and data.
- After a disaster, power on water-exposed equipment only when safe and after consulting insurers and experts.
Workplace violence and insider threat
Train managers to spot warning signs, provide reporting channels, coordinate HR, legal and security, and act promptly on credible threats.
How the exam asks about this
- "Confirm whether a forced-door alarm is real before dispatching a guard." Camera assessment linked to the alarm.
- "Staff travelling to a high-risk country with sensitive data." Travel briefings and loaner devices with minimal data.
- "A signal that an employee is being coerced at the entry point." A duress code.
What to remember for the exam
- Perimeter: fences, bollards, lighting, cameras, sensors, guards.
- Internal: vestibules, multifactor entry, escorts, alarms.
- Guards provide judgment; cameras verify alarms; sensors cover long perimeters.
- Personnel safety: travel, training, emergency management, duress.
- Life safety always comes first.
Never trade life safety for asset protection. Blocking exits or failing doors secure on escape routes endangers people and breaks codes.
Common mistakes
Choosing guards everywhere when sensors or cameras fit better.
Forgetting travel risk for staff and their devices.
Prioritizing equipment over people during emergencies.
Check yourself
Which physical control can apply judgment to challenge unfamiliar people?
Trained security guards.
What is a duress code?
A signal that lets someone indicate silently that they are being coerced.
Should doors on escape routes fail safe or fail secure?
Fail safe, so people can get out.
Topic 9 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.