Audit Checklist for Physical Security

Standard Operating Procedure: Physical Security Audit & Enterprise Infrastructure Assessment

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory methodology, technical requirements, and governance framework for conducting physical security audits across all enterprise-owned and leased facilities, including corporate headquarters, regional offices, R&D labs, and Tier III/IV data centers. The objective is to identify vulnerabilities, verify operational integrity of physical access control systems (PACS), intrusion detection systems (IDS), closed-circuit television (CCTV) coverage, environmental monitoring, and life-safety systems.

2.2 Regulatory Standards & Frameworks

Audits executed under this SOP must maintain strict compliance with the following international, federal, and industry-specific standards:

• ISO/IEC 27001:2022: Information security management systems — Security controls (Clause A.11: Physical and environmental security).
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations (PE: Physical and Environmental Protection family).
• CISA Cybersecurity Performance Goals (CPGs): Baseline security practices for critical infrastructure.
• PCI-DSS v4.0: Requirement 9 (Restrict physical access to cardholder data).
• SOC 2 Trust Services Criteria: Common Criteria 6.4 (Physical access restrictions).

---

3. Prerequisites & Tool Requirements

3.1 Hardware & Technical Equipment

• Calibrated Digital Light Meter: For measuring foot-candles/lux in egress paths and perimeter zones (NIST-traceable calibration).
• Multimeter & Toner Probe: For testing door contact sensors, request-to-exit (REX) units, and circuit continuity.
• Credential Cloner / RFID Sniffer (Authorized): FSK/HID iClass/SEOS testing apparatus to evaluate credential encryption and cloning resistance.
• Laser Distance Meter: For verifying camera focal coverage, perimeter buffer zones, and barrier heights.
• Enterprise Laptop: Pre-loaded with PACS management client, VMS diagnostic tools, IP scanner, and encrypted auditing software.

3.2 Software Access & Permissions

• Read/Diagnostic access to Physical Access Control System (PACS - e.g., OnGuard, Genetec Synergis).
• Read/Playback access to Video Management System (VMS - e.g., Milestone XProtect, Genetec Security Center).
• Read access to Visitor Management System (VMS) logs and Security Incident Management (SIM) ticketing systems.

3.3 Certifications & Personal Protective Equipment (PPE)

• Personnel Certifications: ASIS CPP (Certified Protection Professional), PSP (Physical Security Professional), or CISSP.
• Mandatory PPE: Steel-toe boots, high-visibility safety vest, enterprise-issued security credentials, and safety glasses (required for server room/generator inspections).

---

4. Roles & Responsibilities (RACI Matrix Table)

Designations: Responsible (does the work), Accountable (owns the outcome), Consulted (provides input), Informed (kept updated).

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Briefing & Documentation Review

• 1.1 Convene an opening conference with the Facility Manager and local security leads to verify audit scope, emergency egress procedures, and safety protocols.
• 1.2 Review previous audit reports, outstanding ticket logs from the SIM, and historical tailgating/prop-door incident metrics from the last 12 months.
• 1.3 Export active credential holder rosters from the PACS, cross-referencing terminated employee lists against active access profiles to ensure zero ghost-credential leakage.

Phase 2: Perimeter & Exterior Inspection

• 2.1 Inspect exterior perimeter barriers (fencing, gates, bollards, and vehicle access points) for structural integrity, corrosion, and breach vulnerability.
• 2.2 Verify emergency generator compound, fuel storage tanks, and external HVAC chiller yards are enclosed within secure, locked, anti-climb fencing with active intrusion detection.
• 2.3 Measure exterior lighting levels using the digital light meter; verify minimum compliance of 5 foot-candles (54 lux) across all entry points, loading docks, and walkways.
• 2.4 Test exterior emergency call boxes and intercom systems, verifying two-way audio clarity and direct routing to the Security Operations Center (SOC).

Phase 3: Access Control & Entry Point Assessment

• 3.1 Inspect main reception and turnstile checkpoints; evaluate visitor logging procedures, physical ID verification protocols, and bag-screening workflows.
• 3.2 Test a sampling of 10% of all exterior and interior card readers for anti-tamper mechanisms, skimmer attachments, and secure OSDP (Open Supervised Device Protocol) communication.
• 3.3 Execute live physical penetration testing of turnstiles and mantrap portals to quantify tailgating and piggybacking vulnerability rates.
• 3.4 Verify Request-to-Exit (REX) sensor configurations on emergency exit doors; ensure motion sensors and mechanical crash bars are calibrated to prevent sensor spoofing via thermal or physical manipulation.
• 3.5 Check door contact sensors (magnetic reed switches) on all high-security doors to confirm instant alarm generation at the SOC upon forced-entry or door-propped scenarios exceeding 30 seconds.

Phase 4: Video Surveillance (CCTV) & Monitoring Infrastructure

• 4.1 Conduct a 100% inventory audit of physical cameras against the master VMS layout diagram; identify blind spots, blocked fields of view (FOV), and vandalized housings.
• 4.2 Verify camera recording retention periods meet enterprise compliance minimums (e.g., 90 days for high-security corridors, 30 days for general areas).
• 4.3 Test PTZ (Pan-Tilt-Zoom) functionality, auto-tracking capabilities, and presets from the primary and secondary monitoring consoles.
• 4.4 Inspect the physical security operations center (SOC) for clean-desk compliance, visitor control, uninterruptible power supply (UPS) backup status, and physical access restrictions to the control room.

Phase 5: High-Risk Zones & Server Room Security

• 5.1 Audit Server Room / Main Distribution Frame (MDF) access logs for unauthorized entry attempts over the preceding quarter.
• 5.2 Verify dual-authentication (e.g., smart card + biometric or PIN) is enforced for all Tier-1 data center enclosures.
• 5.3 Inspect rack-level physical security (side panels, front/rear door locks, and key management cabinets); ensure physical keys to racks are strictly inventoried and dual-custody managed.
• 5.4 Test environmental monitoring systems (temperature, humidity, water leak detection, and VESDA early-smoke detection) for integration with automated HVAC shutoff and SOC alarm triggers.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist Acceptance Benchmarks

To achieve a satisfactory audit rating, the audited facility must meet or exceed the following quantitative thresholds:

6.2 Corrective Action Plan (CAP) Issuance

Any "Critical Failure" identified during the audit mandates the immediate generation of an emergency Corrective Action Plan (CAP). The CAP must be delivered to the Chief Security Officer and Facility Manager within 24 hours of audit completion, with remediation executed inside 7 business days.

---

7. Practical Troubleshooting Scenarios

Scenario A: Intermittent OSDP Communication Drop on Perimeter Card Readers

• Symptom: PACS console reports intermittent offline status for external parking garage readers during heavy precipitation, resulting in unauthenticated badge delays or door lockouts.
• Immediate Corrective Action Protocol:
  1. Dispatch a field technician with a multimeter to inspect the junction box nearest the affected reader.
  2. Check for water ingress, oxidized terminal blocks, and improper grounding shield termination (ensure drain wire is grounded at the panel end only to prevent ground loops).
  3. Verify that RS-485 line terminators (120-ohm resistors) are properly installed at both ends of the bus.
  4. If water damage is verified, replace the backplate gasket, seal the conduit entry with duct-seal compound, and log a permanent ticket for hardware enclosure replacement.

Scenario B: Biometric Reader High False Rejection Rate (FRR) in High-Traffic Corridor

• Symptom: Employees report a > 15% failure rate on optical fingerprint scanners during morning shift change, leading to manual guard overrides and severe queue congestion at the main turnstile bank.
• Immediate Corrective Action Protocol:
  1. Inspect the optical glass platen for smudges, scratches, or micro-abrasions using a magnifying glass and clean with an approved isopropyl alcohol optical wipe.
  2. Check ambient light sensor readings around the turnstile; direct sunlight or high-intensity overhead LED glare may be saturating the optical sensor array. Adjust physical shroud/hood or recalibrate exposure settings via the reader firmware utility.
  3. Export matching score logs from the PACS database to determine if template degradation is occurring due to dry skin or seasonal factors; issue a temporary secondary credential (mobile credential/RFID card) for affected personnel while templates are re-enrolled.

Scenario C: Unmonitored Blind Spot Created by New Office Partition Construction

• Symptom: During Phase 4 audit, newly erected drywall partitions for executive offices are found to have blocked the fixed-lens field of view of CCTV camera CAM-SEC-042, completely obscuring the emergency exit corridor.
• Immediate Corrective Action Protocol:
  1. Issue an immediate physical security incident ticket designating the blind spot as a temporary "Zone of Reduced Visibility."
  2. Deploy a temporary mobile IP PTZ camera mounted on a tripod to cover the unmonitored corridor vector within 4 hours.
  3. Coordinate with the Facilities project team to issue an Engineering Change Order (ECO) to either relocate CAM-SEC-042 to the new partition wall or install a secondary complementary wide-angle dome camera (CAM-SEC-042B) to restore full overlapping coverage.