Physical security

Physical security is the control domain that protects the tangible environment of information: sites, rooms, cabling, devices and paper. ISO/IEC 27002:2022 gathers it under clause 7 (Physical controls), which spans physical security perimeters, entry controls, securing offices and facilities, protection against physical and environmental threats, working in secure areas, clear desk and clear screen, equipment siting and protection, supporting utilities, cabling security, equipment maintenance, and secure disposal or re-use of equipment. These sit alongside the organisational, people and technological controls in the same standard, reflecting that a control failure in any one domain can undo the others.

In practice physical controls are layered in concentric rings - site fence, building, floor, room, cabinet - so that defeating one barrier does not grant access to the asset, a physical analogue of defence-in-depth. Deterrent, preventive, detective and corrective measures are combined: fencing and lighting deter, card readers and mantraps (interlocking double-door vestibules that defeat tailgating) prevent, CCTV and intrusion sensors detect, and guards or response procedures correct. A central threat is tailgating or piggybacking, where an unauthorised person follows an authorised one through a controlled door; anti-passback logic in the access system and mantraps are the standard countermeasures. Environmental protection is equally part of the domain: fire detection and suppression (VESDA aspirating detection, inert-gas or clean-agent systems rather than water in server rooms), redundant power via UPS and generators, and HVAC for temperature and humidity all defend availability, since a flood or overheating ends service as effectively as an intruder.

Data centres formalise this with tiered availability models: the Uptime Institute Tier I-IV classification (Tier IV being fault-tolerant with concurrently maintainable, redundant infrastructure) and the EN 50600 series in Europe define expected redundancy and physical protection. Access is typically logged and often gated by multi-factor physical authentication (card plus PIN or biometric), and racks themselves are locked so that colocation tenants cannot reach each other's hardware.

A key principle is that physical access frequently defeats logical controls: an attacker with hands on a device can boot from external media, extract disks, capture data from memory (cold-boot attacks), attach a hardware keylogger, or plant a rogue network implant, which is why full-disk encryption, disabled boot from removable media, port control and tamper-evident seals matter. A common misconception is that physical security is a facilities concern separate from cyber; NIS2 and ISO 27001 treat it as an integral part of information security precisely because so many logical protections assume the attacker is remote. Secure disposal is the frequently forgotten end of the lifecycle: drives and multifunction printers retain data and must be sanitised (per NIST SP 800-88 media-sanitisation guidance) or physically destroyed before disposal.