Physical Security Incident Report Template

Standard Operating Procedure: Physical Security Incident Report (PSIR) Execution & Lifecycle Management

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory, end-to-end lifecycle for identifying, logging, investigating, and remediating physical security breaches, anomalies, and unauthorized access events across all enterprise-owned, leased, or managed facilities. The scope encompasses perimeter defenses, access control systems (ACS), closed-circuit television (CCTV) infrastructure, intrusion detection systems (IDS), and human-factor security breaches.

2.2 Regulatory Standards & Compliance Framework

Execution of this SOP ensures strict adherence to the following governance frameworks:

• ISO/IEC 27001:2013/2022: Information Security Management (specifically Annex A.11 - Physical and Environmental Security).
• NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide (applied to physical-cyber convergence).
• OSHA 29 CFR 1910: Workplace Safety Standards governing emergency action plans.
• GDPR / CCPA: Mandatory privacy compliance during the collection and retention of physical surveillance data and Personally Identifiable Information (PII).

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires the following baseline inventory of equipment, software, credentials, and Personal Protective Equipment (PPE):

• Software & Systems Access:
  • Enterprise Physical Access Control System (PACS) administrative client (e.g., Genetec Security Center, Software House CCure).
  • Video Management System (VMS) export utility with forensic watermarking enabled.
  • Enterprise Security Incident Management (SIM) or Governance, Risk, and Compliance (GRC) platform for ticketing.
  • Secure, encrypted communication channels (e.g., FIPS 140-2 validated push-to-talk radios, encrypted VoIP).
• Hardware & Tools:
  • High-definition digital forensic camera with GPS timestamping.
  • Tamper-evident evidence collection bags, chain-of-custody tags, and nitrile gloves.
  • Calibrated multimeters and line-testers (for access control hardware failure diagnostics).
• Certifications & Clearances:
  • Active Certified Protection Professional (CPP) or Physical Security Professional (PSP) designation (preferred for Lead Investigators).
  • OSHA 10-Hour General Industry Certification.
  • Corporate Insider Threat and Chain-of-Custody Certification.
• Personal Protective Equipment (PPE):
  • Class 2 High-Visibility Safety Vest.
  • ANSI Z87.1 Approved Safety Footwear (Steel-Toe).
  • Cut-resistant tactical gloves (EN 388 Level 5).

---

4. Roles & Responsibilities (RACI Matrix Table)

Definitions:

• Responsible (R): The role that performs the activity to achieve the deliverable.
• Accountable (A): The sole role with final approval and fiduciary/operational accountability.
• Consulted (C): Subject matter experts providing critical inputs prior to execution.
• Informed (I): Stakeholders updated on operational status and closure metrics.

---

5. Step-by-Step Operational Procedure

Phase 1: Detection, Triage, and Initial Logging

• 1.1 Receive and ingest the physical security alert from IDS, ACS panic hardware, or direct human observation via the SOC ticketing console.
• 1.2 Verify the authenticity of the alert by cross-referencing live VMS feeds with corresponding door-contact and motion-sensor telemetry.
• 1.3 Assign an alphanumeric Incident ID utilizing the standard enterprise schema: PSIR-[YYYY]-[MM]-[FacilityCode]-[Sequence].
• 1.4 Classify the incident severity utilizing the enterprise risk matrix (Severity 1: Critical Life Safety/Breach; Severity 2: Significant Unauthorized Access; Severity 3: Minor Anomaly/Tailgating).
• 1.5 Dispatch the nearest available Field Security Officer (FSO) to the scene with a mandated 4-minute maximum response SLA for Severity 1 and 2 events.

Phase 2: Containment, Investigation, and Evidence Preservation

• 2.1 Establish a secure operational perimeter around the incident zone using physical barrier tape and access restrictions if a dynamic threat persists.
• 2.2 Conduct a thorough physical sweep of the zone, inspecting door locks, window latches, structural framing, and intrusion sensors for signs of forced entry or tampering.
• 2.3 Initiate the Digital Evidence Extraction protocol within the VMS, exporting all relevant camera angles covering 15 minutes pre- and 30 minutes post-incident timestamp.
• 2.4 Secure physical evidence (e.g., dropped items, tools, damaged hardware) in tamper-evident bags and complete the Chain-of-Custody Form (CoC-Form-09).
• 2.5 Log all witness testimonies, identifying badge numbers, visitor logs, and access attempts from the PACS event history database.

Phase 3: Reporting, Remediation, and Executive Escalation

• 3.1 Populate the formal Physical Security Incident Report (PSIR) template within the GRC platform, ensuring all mandatory fields (Time, Location, Asset Impact, Threat Actor Profile) are complete.
• 3.2 Submit the completed draft PSIR to the Physical Security Incident Commander (PSIC) for operational review.
• 3.3 Notify Legal Counsel and Privacy Officer immediately if the incident involves PII breach, suspected corporate espionage, or potential litigation.
• 3.4 Issue automated executive summary notifications to stakeholders based on the severity tier (Severity 1 requires C-suite and Board notification within 2 hours).
• 3.5 Dispatch maintenance or facilities tickets to remediate compromised physical barriers (e.g., strike plate replacement, door re-keying, camera realignment) within a 12-hour window.

Phase 4: Post-Incident Review and Closure

• 4.1 Convene a mandatory After-Action Review (AAR) meeting with the FSO, SOC, and PSIC within 48 business hours of incident containment.
• 4.2 Identify root causes utilizing the "5 Whys" failure analysis methodology and document preventative actions in the Continuous Improvement Register.
• 4.3 Update access control permissions, revoke compromised credentials, and recalibrate sensor thresholds as indicated by the AAR findings.
• 4.4 Formally sign off on the PSIR ticket, changing its status from "Under Investigation" to "Closed - Remediated" in the GRC system.

---

6. Quality Assurance & Verification Criteria

To maintain institutional compliance, every executed PSIR lifecycle must be audited against the following benchmark metrics:

• Audit Checklist Requirements:
  • Timestamp integrity: Every log entry must utilize synchronized Network Time Protocol (NTP) servers across all ACS, VMS, and ticketing systems.
  • Chain-of-Custody completeness: Zero gaps in signatures from the point of collection to secure archival.
  • Redaction verification: All extraneous PII of non-involved bystanders must be blurred/redacted from exported VMS footage prior to external distribution.
• Tolerance Thresholds:
  • Time-to-Log (TTL): Must not exceed 5 minutes from initial alert reception to ticket generation.
  • Time-to-Contain (TTC): Must not exceed 15 minutes for physical perimeter lockdown by FSOs.
  • Report Completion SLA: 100% of Severity 1 and 2 PSIRs must be fully compiled and approved within 24 hours of incident closure.
• Acceptance Benchmarks: A security audit score of $\ge 98%$ compliance is required during quarterly ISO/IEC internal reviews. Failure to meet audit thresholds triggers a mandatory operational review by the Director of Global Physical Security.

---

7. Practical Troubleshooting Scenarios

Scenario A: VMS Storage Corruption and Failure to Export Evidence

• Symptom: During Phase 2, the SOC operator attempts to export CCTV footage, but the VMS client throws a "Storage Node Unreachable / Write Error 503" notification, preventing evidence preservation.
• Immediate Corrective Action Protocol:
  1. Immediately bypass the primary local VMS client and log into the secondary, hot-standby Edge Recording Server via direct IP address using enterprise administrative credentials.
  2. Locate the localized camera buffer cache on the physical IP-camera SD card (if equipped with edge-storage failover) and initiate a direct manual pull via ONVIF-compliant utility.
  3. If edge storage is unavailable, issue an emergency ticket to the IT Infrastructure team to restart the VMS Storage Service daemon (vms-store-svc.exe).
  4. Document the exact time of the storage failure in the PSIR metadata section to preserve legal chain-of-custody defense against allegations of spoliation of evidence.

Scenario B: Access Control System (PACS) Database Outage During Active Breach

• Symptom: An active intrusion alarm sounds, but the primary PACS database loses connectivity, rendering badge readers offline and freezing the graphical map interface.
• Immediate Corrective Action Protocol:
  1. Instantly direct all on-site FSOs to switch from automated monitoring to manual physical patrols and lock-down mode using physical hard keys stored in the master key safes.
  2. Trigger the local panel offline fallback mode; verify that local access control panels have dropped into standalone memory operation to secure perimeter portals locally.
  3. Contact the Enterprise Systems Administrator to execute the automated failover script to bring the redundant SQL database cluster online.
  4. Manually log all manual door overrides and physical entry/exit events on paper logs until digital connectivity is fully restored and reconciled.

Scenario C: Discovery of Unidentified, Tampered Sensor Hardware (Potential Insider Threat)

• Symptom: During a routine physical security inspection following an anomaly, an FSO discovers an unauthorized hardware device (e.g., a rogue network sniffer or relay bypass module) spliced into the door strike wiring.
• Immediate Corrective Action Protocol:
  1. DO NOT TOUCH OR REMOVE THE DEVICE. Touching unhandled hardware risks destroying latent fingerprints and DNA evidence.
  2. Establish an immediate physical exclusion zone (10-meter radius) to prevent contamination of the crime scene.
  3. Contact Corporate Legal, the Chief Information Security Officer (CISO), and local law enforcement cyber/physical crimes units immediately.
  4. Request a forensic technician to photograph, dust for latent prints, and legally excise the hardware under strict chain-of-custody protocols. Log the event as a Severity 1 Critical Infrastructure Compromise.