Physical security, personnel safety and Domain 7 review

Security operations does not stop at the network edge. Data centers, offices, warehouses and plants hold equipment and information that can be stolen, damaged or misused by someone who simply walks in, and the people who work there must be kept safe at work, while traveling and in emergencies. The CISSP outline addresses this in sub-domains 7.14 (implement and manage physical security: perimeter and internal security controls) and 7.15 (address personnel safety and security concerns: travel, security training and awareness, emergency management and duress). CISSP-114 covered site and facility design, such as site selection, fire suppression and environmental controls; this lesson focuses on operating physical security day to day. Occupational health and safety duties, such as workplace hazard assessment and first aid, are covered in the HSE courses.

The final part of the lesson draws the course together with a capstone scenario for an invented organization and a short guide to Domain 7 questions on the exam.

Crime prevention through environmental design

Crime prevention through environmental design (CPTED) is an approach that uses the design and management of the built environment to discourage crime and make legitimate use feel natural. It is a low-cost, often overlooked first layer. Its classic principles are natural surveillance (arranging windows, lighting and landscaping so that people can see and be seen), natural access control (guiding people toward controlled entrances with paths, fences and landscaping), territorial reinforcement (signs, fencing and design that show where public space ends and private space begins) and maintenance (keeping the property in good repair, because neglect signals that no one is watching).

Layered physical controls

Physical security follows the same defense-in-depth principle as logical security. Controls are arranged in layers from the outside in, so that an intruder must defeat several to reach valuable assets, and so that each layer gives time for detection and response. A useful way to think about each layer is deter, detect, delay, respond: lighting and signs deter; alarms and cameras detect; fences, doors and locks delay; guards and police respond. Delay is only useful if detection and response happen faster than an intruder can get through.

Several physical controls are frequent exam topics. A mantrap (also called an access control vestibule) is a small space with two doors where only one can open at a time, preventing tailgating and piggybacking, where an unauthorized person follows an authorized one through a door. Locks range from mechanical keys, which are hard to manage because keys can be copied and are rarely recovered, to electronic access control systems that record every entry and can revoke a badge instantly. Fail-safe and fail-secure describe how electronic locks behave on power loss: fail-safe doors unlock, protecting people's ability to leave, while fail-secure doors stay locked, protecting assets. Life safety comes first, so doors on emergency exit routes must allow people out, as fire and building codes in both countries require.

Cameras (CCTV or IP video) deter and provide evidence, but only if someone watches live feeds when needed, footage is retained for a defined period and retrieval is tested. Privacy law applies: in Canada, privacy commissioners expect video surveillance to be justified, limited to what is necessary and accompanied by notice; in the United States, state laws restrict audio recording and cameras in places where people expect privacy. Guards provide judgment and response that technology cannot, and guard dogs are sometimes used at high-security sites, but both need training, supervision and clear post orders.

Badge audits and access reviews

Electronic access control systems produce logs that security operations should review just as it reviews logical access. Common checks include dormant badges (assigned but unused for a long period, often belonging to people who have left), badges with access beyond their holder's role, access outside normal hours, repeated denied attempts, door-held-open and forced-door alarms, and badges used at two distant doors within an impossibly short time, which suggests a cloned or shared badge. Badge access to sensitive areas such as data centers should be recertified by area owners at least quarterly, and leaver processes must revoke physical access at the same time as logical access.

import random
from datetime import datetime, timedelta
random.seed(5)
# Badge audit on synthetic access logs: dormant badges, departed holders, after-hours server room entries, impossible travel
doors = {'HQ-lobby': 'Toronto', 'HQ-serverroom': 'Toronto', 'WH-dock': 'Mississauga', 'DC2-cage': 'Montreal'}
home = {'Toronto': ['HQ-lobby', 'HQ-serverroom'], 'Mississauga': ['WH-dock'], 'Montreal': ['DC2-cage']}
badges = {f'B{n:04d}': random.choice(['Toronto', 'Toronto', 'Mississauga', 'Montreal']) for n in range(1, 61)}
departed = {'B0007'}                    # holder left; badge never revoked
start = datetime(2026, 9, 1)
log = []
for _ in range(1500):
    b = random.choice([x for x in list(badges)[:52] if x not in departed])
    day = start + timedelta(days=random.randint(0, 29))
    t = day + timedelta(hours=random.choice([7, 8, 9, 10, 11, 13, 14, 15, 16, 17]), minutes=random.randint(0, 59))
    log.append((t, b, random.choice(home[badges[b]])))
log.append((datetime(2026, 9, 14, 2, 10), 'B0007', 'HQ-serverroom'))
log += [(datetime(2026, 9, 9, 23, 40), 'B0003', 'HQ-serverroom'), (datetime(2026, 9, 22, 4, 5), 'B0019', 'HQ-serverroom')]
log.append((datetime(2026, 9, 20, 9, 0), 'B0012', 'HQ-lobby'))
log.append((datetime(2026, 9, 20, 9, 25), 'B0012', 'DC2-cage'))
log.sort()
used = {b for _, b, _ in log}
dormant = sorted(b for b in badges if b not in used)
print(f'{len(dormant)} dormant badges (no use in 30 days): {", ".join(dormant)}')
for t, b, d in log:
    if b in departed:
        print(f'ERROR {t:%Y-%m-%d %H:%M} badge {b} of departed holder used at {d}')
after_dc = [b for t, b, d in log if d == 'HQ-serverroom' and (t.hour < 6 or t.hour >= 22)]
print(f'WARN {len(after_dc)} after-hours server room entries to confirm against change tickets')
last = {}
for t, b, d in log:
    if b in last and doors[last[b][1]] != doors[d] and (t - last[b][0]) < timedelta(hours=2):
        print(f'WARN {b} at {last[b][1]} then {d} after {(t - last[b][0]).seconds // 60} min: impossible travel')
    last[b] = (t, d)

8 dormant badges (no use in 30 days): B0053, B0054, B0055, B0056, B0057, B0058, B0059, B0060
ERROR 2026-09-14 02:10 badge B0007 of departed holder used at HQ-serverroom
WARN 3 after-hours server room entries to confirm against change tickets
WARN B0012 at HQ-lobby then DC2-cage after 25 min: impossible travel

Each finding leads to a management action. Dormant badges are disabled after confirmation with managers. The departed holder's badge use is a serious finding that needs investigation and a fix to the leaver process linking HR and physical access. After-hours data center entries are confirmed against change tickets. Impossible-travel results are often a sign of badge sharing or cloning, which breaches policy and undermines accountability.

Visitors, deliveries and contractors

Visitor management turns an unknown person into an identified, escorted and recorded one. Good practice includes pre-registration by a host, identity checks at reception, visible visitor badges that expire, escorts in non-public areas, and a log retained according to policy. Contractors who work on site for longer periods should be screened to a level suited to their access and given badges that expire with their contract. Deliveries should go to a controlled receiving area rather than wandering the building. Staff should be encouraged, and trained, to politely challenge or report people without visible badges; social engineering attempts to enter buildings by tailgating or impersonating delivery or maintenance workers rely on staff being reluctant to do so.

Personnel safety: travel, duress and emergencies

Organizations have a duty of care for employees, including when they travel. A travel security program gives travelers advice for their destination, registers their itinerary so they can be located in an emergency, and provides a contact for help. For information security, high-risk destinations may call for loaner laptops and phones with minimal data, prohibitions on carrying certain information, use of the organization's VPN on untrusted networks, and checking devices on return. Border officers in both countries have broad powers to examine devices at the border; travelers should be told in advance what to expect and should not carry more data than they need.

Duress is a situation in which someone is forced to act against their will, for example being coerced at gunpoint to open a vault or disable an alarm. Duress controls let people signal for help without alerting the person threatening them: duress codes on alarm panels that appear to disarm the system while silently calling for help, panic buttons at reception desks and cash points, and code words for phone calls. Training emphasizes that personal safety comes first: staff should comply with threats and signal when safe, not resist.

Emergency management covers events such as fire, severe weather, medical emergencies, active threats and hazardous material releases. The occupant emergency plan sets out evacuation and shelter-in-place procedures, assembly points, accountability (knowing who is in the building and confirming who is safe), roles such as floor wardens, and communication with emergency services. Mass notification systems send alerts by text, voice and email. Security operations often supports emergency management through access control data that shows who is on site, and through camera and alarm monitoring. The occupational health and safety foundations of emergency preparedness are covered in the HSE courses.

Capstone: Northfield Freight

Northfield Freight is an invented logistics company with 1,800 employees, headquarters in Winnipeg, warehouses in Canada and the northern United States, and an online shipment-tracking service used by 40,000 business customers. A new CISO has been asked to report to the board on the state of security operations. Drawing on the whole course, a strong report would address: foundational principles (privileged access management, separation of duties for payment and access approvals, and SOC sourcing with a managed detection partner for overnight coverage); investigations (an evidence handling procedure and legal hold process agreed with counsel); logging (a source inventory, tiered retention sized to the budget and detection rules measured for precision); configuration and change (CIS-based baselines, drift reporting and risk-based change review); incident management (an approved plan aligned to NIST SP 800-61r3, a severity matrix, retainers, tabletop exercises with executives and a reporting matrix covering PIPEDA, Law 25, the relevant US state laws and, for any listed parent, securities rules); detective and preventive measures and insider risk (IPS tuning, allow listing on warehouse kiosks and a governed insider risk program); recovery (a BIA with approved MTDs, recovery tiers, 3-2-1-1-0 backups with restore testing and a costed cloud recovery strategy, tested progressively); and physical security and safety (CPTED improvements at warehouses, quarterly badge audits, visitor management, a travel program and emergency drills).

# Capstone scorecard: maturity per course area (0-4) with target and gap, synthetic self-assessment
areas = [
    ('Principles, PAM and SOC', 2, 3), ('Investigations and evidence', 1, 3), ('Logging and detection', 2, 3),
    ('Configuration, change, patching', 2, 3), ('Incident management', 1, 3), ('Reporting obligations', 1, 3),
    ('Detective/preventive and insider risk', 2, 3), ('BIA and recovery objectives', 1, 3), ('Backup and resilience', 2, 4),
    ('DR sites and testing', 1, 3), ('Physical security and safety', 2, 3),
]
gaps = sorted(areas, key=lambda a: a[1] - a[2])
for name, now, target in gaps:
    bar = '#' * now + '.' * (target - now)
    print(f'{name:38s} {now}/{target} {bar}')
print('Largest gaps first: ' + ', '.join(n for n, c, t in gaps[:3]))

Investigations and evidence            1/3 #..
Incident management                    1/3 #..
Reporting obligations                  1/3 #..
BIA and recovery objectives            1/3 #..
Backup and resilience                  2/4 ##..
DR sites and testing                   1/3 #..
Principles, PAM and SOC                2/3 ##.
Logging and detection                  2/3 ##.
Configuration, change, patching        2/3 ##.
Detective/preventive and insider risk  2/3 ##.
Physical security and safety           2/3 ##.
Largest gaps first: Investigations and evidence, Incident management, Reporting obligations

The scorecard is a communication tool for the board, not a precise measurement. Its value is in making priorities explicit and in being repeated each year so progress is visible. A reasonable first-year plan would focus on the largest gaps that also reduce the most risk: an approved incident plan with reporting matrix, a BIA with tested backups, and evidence handling, since these determine how well the company would survive a serious incident in the next twelve months.

Approaching Domain 7 questions

Domain 7 makes up about 13 % of the CISSP exam under the outline effective 15 April 2024 (checked October 2026). This course is independent study material: it is not produced, endorsed or reviewed by ISC2, every question in it is original, and candidates should check the current exam outline on the ISC2 website before booking. Its questions reward a manager's perspective. When several answers are technically possible, prefer the one that follows policy and process, protects people first, preserves evidence and involves the right decision maker. Read for sequence words: first, next, best, most important. Containment comes before eradication; a BIA comes before choosing recovery strategies; legal advice comes before contacting law enforcement or making public statements in sensitive cases; and lessons learned is a required step. Distinguish similar terms carefully: RTO and RPO, MTD and RTO, hot and warm sites, parallel and full interruption tests, enticement and entrapment, fail-safe and fail-secure, incremental and differential backups.