How long does a physical security assessment take?

For a typical commercial office or single facility, a professional physical security assessment requires one to three days on-site for observation and interviews, followed by report production. Larger facilities, multi-site assessments, or assessments requiring covert testing components (social engineering, physical penetration testing of access controls) take longer. Mission Support scopes the assessment duration based on the facility size, complexity, and specific areas of concern.

What is the difference between a physical security assessment and a penetration test?

A physical security assessment evaluates existing controls through observation, interview, and document review — it identifies gaps without necessarily exploiting them. A physical penetration test actively attempts to bypass the controls — gaining unauthorised access to test whether the controls actually work in practice. Both are valuable; the penetration test confirms whether the assessment's identified gaps are actually exploitable. Mission Support provides both.

Who should be present during a physical security assessment?

The physical security manager or facilities manager, the HR lead (for personnel security components), the IT security lead (for technology systems integration), and senior management representation for the threat assessment briefing. Covert testing components should involve only the commissioning individual — not the staff being tested.

Physical Security Assessment — Complete Guide

Why physical security assessments fail to deliver value

Generic, compliance-oriented physical security assessments produce long lists of 'best practice' recommendations with no prioritisation by actual risk. A professional assessment is threat-driven: it starts with who might target this organisation, what their capability is, and what they are most likely to do — and evaluates the existing controls against that specific threat, not against a generic standard.

Assessment components

Perimeter analysis

Evaluation of the outer perimeter — fencing, vehicle barriers, lighting, CCTV coverage, and natural features — against the threat model. Specific focus on: dead zones not covered by observation, vehicle-borne threat vectors (ram raids, vehicle-borne improvised explosive devices for higher-threat environments), and the deterrence value versus penetration difficulty of the current perimeter.

Access control review

Assessment of access control at all entry points — physical barriers, electronic access systems, visitor management processes, and the vetting of contractors and deliveries. Most access control failures are procedural rather than technical: systems that work correctly but are bypassed by poorly trained staff or inadequate procedures.

CCTV and detection systems

Evaluation of camera placement, coverage, resolution, storage, and monitoring — including the monitoring capability (is footage watched in real time, or only reviewed after an incident?). Integration with alarm systems, access control, and response procedures.

Personnel security

Review of pre-employment screening standards for all staff, with particular focus on roles with physical access to sensitive areas. Insider-threat indicators programme — the behavioural and procedural signals that indicate potential insider compromise. Most physical security breaches involve insider access, either recruited or inadvertent.

Information exposure

Physical information security — clean-desk policy compliance, physical document handling and destruction, whiteboard and screen visibility in areas accessible to visitors, and the procedures preventing sensitive information from being visible or accessible to unauthorised parties on site.

What the output should include

Threat summary — who the assessed threat actors are and what their most likely methods are
Findings — specific identified gaps, not generic observations
Risk rating per finding — severity and likelihood combined
Prioritised recommendations — what to fix first and why
Implementation guidance — enough specificity to act on without additional consulting
Residual risk statement — what risk remains after recommended measures are implemented

A physical security assessment without a prioritised recommendation list and implementation guidance is a gap document, not an assessment. Mission Support delivers assessments that are actionable from the day they are received.

Physical security assessment — a complete guide