Physical Security Assessment
Reviewing whether physical access to your office and server room matches what you assume it does.
Who this is for: Businesses with a physical office, server room, or data closet that’s never had its physical access controls formally reviewed.
The Problem
A locked front door doesn’t mean much if a visitor badge is never checked, a server room is unlocked “just for today,” or an ex-employee’s badge was never deactivated.
Our Solution
We review physical access controls, badge policies, visitor management, and server-room security, and where appropriate, test them directly through physical social engineering.
What's included
- Office access control review
- Server-room and data-closet access review
- Badge and key control audit
- Visitor management process review
- Physical social engineering testing (tailgating, pretexting) where in scope
This is a smaller-scope engagement most relevant to businesses with sensitive on-site infrastructure, a server room, network closet, or storage of physical records, rather than every business with an office lease.
Benefits
- A clear picture of who can actually access sensitive areas
- Gaps like un-deactivated ex-employee badges caught and fixed
- A tested, not assumed, visitor management process
Our Process
Review
Assess current access controls and policies.
Test
Where in scope, test physical social engineering resistance.
Identify Gaps
Flag stale badges, unlocked areas, and process gaps.
Recommend
Deliver practical, prioritized fixes.
Follow Up
Confirm fixes were implemented.
Frequently asked questions
Does this include actually trying to access your office?
Physical social engineering testing (like tailgating) is available where explicitly agreed to in scope; it’s not part of a standard review unless requested.
Is this relevant if we don’t have a server room?
It’s most valuable for businesses with on-site sensitive infrastructure or physical records; a general office review can still be useful but is a smaller-scope engagement.
Related services
Penetration Testing
Simulating real-world attacks against your network, web apps, or staff to uncover vulnerabilities before someone else does.
settingsSecurity Configuration
Hardening operating systems, cloud accounts, and applications against CIS/NIST baselines, not just the defaults they shipped with.
monitoringVulnerability Management
Continuous scanning, risk-based prioritization, and patch tracking, so fixes don’t sit in a backlog until an audit finds them.
Not sure if this is the right fit?
Tell us what's worrying you. We'll tell you what actually needs fixing first.