Physical security testing

Test whether the controls around a named site protect a specific room, workstation or network access point. The buyer sees where access was challenged, which process allowed it to continue and what needs to change.

Does the visitor check stop at the agreed checkpoint?

A visitor receives a badge before the named host confirms the appointment.

Illustrative test report

Authority: The facilities owner approves the premises and the security sponsor agrees the route, exclusions and stop contact.
Evidence: Record the missed host check and the later control that prevented further access. Stop at the agreed checkpoint.
Follow-up: Facilities and security agree a process check or a newly authorised visit after the procedure changes.

When to choose this service

A site has opened, moved or changed access arrangements.
A shared reception, contractor route or public terminal now sits close to a sensitive area.
You need to rehearse how front-of-house staff and security teams report an unexpected visitor.

Select a site, permitted routes, hours, starting position and objective. Visitor handling, controlled doors, escalation procedures and an agreed kiosk or workstation can be included. A social approach by phone, email or in person can be added when the participants, scenario and boundaries are authorised.

What we examine

Whether reception and visitor processes verify identity, host approval and escort requirements.
Whether controls separating public, staff and restricted areas enforce the intended boundary.
How staff challenge or report an unusual request, and how the duty team responds.
Where explicitly in scope, whether a locked-down workstation or kiosk exposes functions beyond its intended use.

What to prepare

Written authority from the premises owner and any relevant third-party site operator.
A site plan, expected visitor workflow, in-scope areas and sensitive exclusions.
The named controller, emergency verification channel, evidence rules and testing window.

Agreed boundaries

Require written site authority, a sponsor, an emergency contact and agreed stop conditions. Set exclusions for sensitive rooms, emergency routes, equipment and third-party premises. No damage, forced entry, real credential collection or live-system interaction is assumed. Review staff actions at process level.

What you receive

Receive an executive summary, an evidence-backed sequence of events, controls that worked, gaps that affected the objective, and prioritised actions for facilities, IT or security. Agree how sensitive photographs and individual details will be handled.

Follow-up

Agree a new authorised visit or a focused process check if a physical control or visitor procedure changes.

Before scoping a visit, ask the facilities owner to confirm authority over the premises and the security sponsor to agree the visitor checkpoint, exclusions and a named contact who can stop the exercise. The tester stops at that checkpoint even if a route continues beyond it.

Tell us the business question, the systems or sites involved and the decision that depends on the result.

Scope a physical security exercise