Physical Security Assessment Checklist for Offices and Data Centers (2026)

A physical security assessment checks whether the controls protecting a building stop someone who does not belong there: the perimeter, reception, badges and locks, server rooms, cameras and alarms, and staff procedures. This checklist covers an office and a data center in 50 checks, each verified by testing rather than asking and mapped to SOC 2, ISO 27001, PCI DSS and HIPAA. Run it yourself, then decide which controls need proof from someone trying to get in.

Invadel does not sell walkthrough audits or risk registers; we run physical penetration testing, authorized attempts to enter your office as an intruder would, from $6,800 for one NYC-metro office, fixed in writing, with a free re-check (see physical penetration testing cost).

Assessment, risk assessment or penetration test?

	Physical security audit	Physical security risk assessment	Physical penetration test
Question	Do the specified controls exist?	Which threats matter, and what to spend on?	Can an outsider get in, and how far?
Method	Walkthrough, document review, interviews	Threat, vulnerability and consequence rated per asset	Entry attempts under signed authorization
Output	Gap list	Risk register and countermeasure plan	Timeline, photos, findings, re-check

With little or no security program, start with CISA’s Security Assessment at First Entry (SAFE), a free walkthrough of no more than two hours by a trained assessor, arranged through your local Protective Security Advisor, for facilities such as schools and houses of worship. This checklist covers entry and information protection, not workplace violence or emergency planning; our security risk assessment guide covers scoring.

How to run a physical security assessment

1. List what you are protecting: server room, network closets, records rooms, trading floors, labs, laptops. Rank them by consequence.
2. Draw the layers from the street inward. Each should deter, detect, deny, delay or defend (the 5 D’s); those around your most valuable rooms should do several.
3. Walk it at the times that matter: arrival, lunch, deliveries, cleaning shifts, after hours.
4. Verify, do not ask. Pull the access control report instead of asking who has access.
5. Score each gap, fix it, and re-check it.

Using the checklist as an audit template

To turn the tables below into a working physical security audit checklist, copy them into a spreadsheet and add these columns to each row:

• Location: the door, floor or room the check was run on. Run door checks once per door, not once per building.
• Result: pass, fail or not applicable, with the date and time of day.
• Evidence: the photo, access control export or log entry that shows it.
• Likelihood, impact and score: filled in for failures only, using the scoring section further down.
• Owner and due date: one named person per failed check.
• Re-check date: when the fix was verified, and by whom.

A row with no evidence is an opinion; an auditor or insurer will ask for the export or the photo.

Office physical security assessment checklist

Perimeter and exterior

Check	How to verify
1. Every exterior door, dock, roof hatch and ground-floor window is inventoried	Walk the outside with the floor plan
2. Paper for disposal goes into locked shred bins, not open recycling	Check the recycling by the printers and the dumpster at the dock
3. Lighting and cameras cover every entrance	Walk it after dark; compare camera views to the door list
4. Smoking areas and loading docks are not a second front door	Watch whether returning staff hold the door for strangers

Lobby, reception and visitors

Check	How to verify
5. Visitors are identified, logged and badged before the first controlled door	Send a colleague from another office as an unannounced vendor
6. Visitor badges look different from staff badges and expire	Try yesterday’s visitor badge on a reader
7. Visitors are escorted beyond reception	Follow a real visit and note where the escort stops
8. Reception verifies “here to fix the printer” stories; deliveries stop at the desk	Check whether reception called the help desk
9. In a multi-tenant building, you know where the landlord’s controls end	Get the building’s procedure in writing; treat your suite door as the perimeter

For card environments, PCI DSS v4.0.1 requires visitor badges surrendered or deactivated before visitors leave or at expiry, and a visitor log kept at least three months (9.3.3, 9.3.4).

Badges and access control

Check	How to verify
10. Card technology resists copying on sensitive doors	Identify the credential type (table below)
11. Leavers and lost badges lose access the same day	Compare active cardholders with HR’s last 90 days of leavers
12. Server room access follows least privilege	Export the access group; every name needs a reason
13. Sensitive doors need a second factor	Try a valid card alone on the server room door
14. Controllers sit on the secure side and readers are tamper-alarmed	Check where the controller is mounted
15. Door-forced and door-held alarms reach a person who responds	Hold a door open after hours and time the reaction

NIST’s guidance for federal PIV badge systems marks static-identifier authentication as deprecated under FIPS 201 (little or no confidence in the holder’s identity), notes that many non-PIV cards copy easily, and sets minimum factors: one for controlled areas, two for limited, three for exclusion areas (NIST SP 800-116 Rev. 1).

Credential	How it works	Assessment
125 kHz proximity (HID Prox, EM4100)	Transmits a fixed number, no cryptography	Copyable; replace on sensitive doors
MIFARE Classic	13.56 MHz, Crypto-1 cipher	Cipher publicly broken in 2008 (Radboud University research); treat like prox
Legacy iCLASS (Standard and Elite keys)	Older HID 13.56 MHz format, proprietary cipher	Master keys recovered in 2012 (Radboud University research); migrate
iCLASS SE/SR	HID’s SIO data object on the iCLASS chip and cipher	Stronger than legacy, but Elite keys were recovered in that research, and credential and administrator keys can be extracted from iCLASS SE reader configuration cards (CVE-2024-23806); lock up or destroy configuration cards and prefer Seos or DESFire with custom keys
DESFire EV2/EV3, Seos	Mutual authentication with AES	Resists simple copying if readers authenticate the card, not just its serial number, and accept no legacy format

A common migration gap is readers that still accept 125 kHz cards or read only the card serial number; either one lets a copied badge through.

Doors, locks and keys

Check	How to verify
16. Controlled, side and stairwell doors close and latch on their own, with latch guards and aligned strikes	Open each fully and let go; at shift change look for wedges, taped latches, dead closers
17. Request-to-exit sensors cannot be triggered from outside	Check sensor aim and coverage; close gaps under and between doors (sweeps, astragals)
18. Free egress hardware cannot be reached from outside	Egress must open from inside without a key; confirm it works one way only
19. Mechanical keys, including overrides on badge doors, are counted and assigned	Reconcile the key log against holders
20. Racks, cabinets and records rooms use real locks	Note shared keys and keys hanging next to the cabinet

Inside the office

Check	How to verify
21. Clean desk: no passwords, badges or sensitive papers, including at printers	Walk the floors after hours
22. Unattended screens lock	Count unlocked machines at lunchtime
23. Jacks in lobbies, meeting rooms and common areas are disabled or 802.1X-authenticated	Plug a laptop into a meeting room jack and see what it reaches
24. New USB and network devices are blocked or logged	Confirm the detection table’s events are collected
25. Guest Wi-Fi is isolated and rogue access points are detected	Connect as a guest and try internal addresses; see wireless penetration testing

Server room and network closets

Check	How to verify
26. The access list is short, named and reviewed	Check the last review date
27. Every network closet is locked and not used as storage	Open each closet door on your floors
28. Walls run to the structural ceiling, not the drop ceiling	Lift a tile beside the door
29. Consoles and KVM sessions lock when not in use	Look at the screens
30. Entries are recorded and reviewed	Match last month’s entries to a person and a reason

Cameras, alarms and monitoring

Check	How to verify
31. Footage identifies a person, not a shape	Review footage of a known entry
32. Retention meets your obligations	Request 90-day-old footage of a sensitive door; for card environments, PCI DSS 9.2.1.1 requires three months of camera or access control records for sensitive areas
33. Alarms are watched in real time, after hours too	With the monitoring center warned so police are not dispatched, trigger an alarm at 9 p.m. and time who calls
34. Camera and access control systems are patched, segmented and off default passwords	Include them in network testing

People and process

Check	How to verify
35. Staff challenge or report people they do not recognize	With management sign-off, have a stranger follow staff in at the busiest door, or have it tested
36. Everyone knows how to report “someone followed me in”	Ask five people at random
37. Cleaners, contractors and building staff have time-limited access	Check which doors their badges open, when
38. Training covers tailgating and pretext calls, not only phishing	Review the content; see vishing

Coworking and shared-office checks

In a coworking space or on a shared floor you control very little of the building, so these extra checks replace much of the perimeter section. They sit outside the numbered 50.

Check	How to verify
Your lockable space (office, cabinet or cage) is the real perimeter, and nothing sensitive lives outside it	Walk the shared areas after hours and note what is yours
You know who else can open your door: operator staff, cleaners, master keys	Ask the operator in writing; request the access log for your door
Network equipment is yours or logically separated from other members	Check which network your wired jacks and Wi-Fi land on and what else is visible there
Printing, calls and screens do not leak to neighbors	Check shared printers for uncollected pages; look at screens from the corridor
Departing staff lose the operator’s badge or app access the same day	Compare the operator’s member list with your HR leavers

Data center physical security checklist

In a public cloud the data center is the provider’s job; colocation splits ownership as below.

Check	How to verify
39. Entry is layered: perimeter, lobby, mantrap, data hall, cage, rack	Count the authentication steps from street to rack
40. The mantrap stops two people on one credential	Watch it in use
41. The data hall needs a biometric or PIN as well as a card	Check at the door
42. Cages are topped and under-floor access is closed	Look up and down at the cage boundary
43. Racks lock individually; keys or codes are controlled	Reconcile the key and code log with current staff; one key should not open every rack
44. Cross-connects run in protected pathways	Trace them out of the cage
45. Inlet temperatures stay in ASHRAE’s recommended envelope	18-27°C (64.4-80.6°F) for air-cooled classes A1 to A4 (ASHRAE TC 9.9)
46. UPS and generator are load-tested; leak detection covers raised floors	Read the last test record and sensor map
47. Fire detection and suppression suit IT spaces	Review inspection records against NFPA 75 and the local fire code
48. Every device in or out is logged and authorized	Match recent shipments to authorizations
49. Drives are sanitized or destroyed, with records	Check certificates against NIST SP 800-88 Rev. 2 clear, purge and destroy methods
50. Access and remote hands lists are current	Compare them with your staff list

Colocation: who owns which control

Control	Operator	You
Perimeter, guards, mantraps, common-area cameras	Operates	Read their SOC 2 Type 2 report, exceptions and complementary user entity controls included, or their ISO 27001 certificate and scope
Access and remote hands lists	Enforces	Owns: quarterly review, same-day removal
Cage and rack locks	Provides	Holds keys and codes
Entry testing	Must consent in writing	Cannot authorize it alone

Detecting physical intrusion

What happened	Where it shows up	What it means
Door forced or held open	Access control alarm	Useless unless someone responds
Access denied, then an entry seconds later	Access control log plus camera	Tailgating after a failed credential
One badge at two distant readers, or an anti-passback violation	Access control log	Copied or shared credential
Badge used after hours or by someone on leave	Access control log plus HR data	Copied, stolen or unrevoked badge
Link up on a dead port, unknown MAC, 802.1X failure	Switch, network access control and DHCP logs	A planted device
New external device recognized	Windows Security event 6416 (requires Audit PNP Activity)	Something plugged into a workstation

The last two rows are MITRE ATT&CK T1200, Hardware Additions, mitigated by 802.1X with device certificates and blocking unknown hardware. An internal network penetration test shows what a planted device could reach.

Scoring findings: the physical security risk assessment

Start with who would try: opportunistic thieves, former employees, vendors and cleaners with access, and anyone after your data or people. Rate each failed check 1 to 3 for likelihood (from that list) and impact (from step 1), then multiply (example ratings below).

Finding	Likelihood	Impact	Score	Fix
Meeting room jacks live on the corporate network	3	3	9	Disable, or require 802.1X
Server room on 125 kHz badges, 40 people with access	2	3	6	Card plus PIN, named administrators only
Loading dock propped most afternoons	3	2	6	Door-held alarm routed to reception
Visitor badges not collected	3	1	3	Self-expiring badges

Fix 9s now, plan 6s this quarter, and schedule the rest or accept them in writing with an owner and review date.

Mapping the checklist to SOC 2, ISO 27001, PCI DSS and HIPAA

Framework	Physical requirement	Checks
SOC 2	CC6.4: physical access to facilities and protected information assets restricted to authorized personnel; CC6.5: physical assets disposed of only after data cannot be recovered (AICPA Trust Services Criteria); both are explained in our SOC 2 controls list	5-15, 26-30, 39-43, 49
ISO 27001:2022	Annex A 7.1 to 7.14, including 7.4 physical security monitoring, new in 2022 (ISO/IEC 27001); the full control set is in our ISO 27001 checklist	All; 7.7 clear desk is 21-22
PCI DSS v4.0.1	Requirement 9: facility entry (9.2.1), monitoring records (9.2.1.1), public network jacks (9.2.2), consoles locked (9.2.4), personnel and visitor access, with immediate revocation on termination (9.3, 9.3.1.1), media (9.4); the other eleven requirements are in our PCI compliance checklist	2, 5-15, 19, 23, 26-32, 48-49
HIPAA	45 CFR 164.310: facility access controls, workstation use and security, device and media controls (eCFR)	1, 3-24, 26-33, 48-49

For healthcare, see the HIPAA compliance checklist and HIPAA administrative and physical safeguards.

What a physical penetration test adds

A checklist confirms a door has a reader; a test shows whether that matters when someone follows an employee in. Testers commonly find tailgating at busy times, propped side doors, proximity badges on sensitive rooms, live jacks in meeting rooms, unlocked closets, and a reception desk that badges a confident story.

Our operators carry a signed authorization letter and follow written rules of engagement: no forced entry, no damage, landlord consent in multi-tenant buildings. After a day of reconnaissance they try tailgating, badge cloning, pretexts and door checks, then test what is reachable inside, including one attempt to plant a network device. You get a timeline with photos, findings by control rather than by person, an attestation letter, and a free re-check.

What it costs to test

Scope	Included	Fixed price
One NYC-metro office, up to about two floors	Two operators, up to three on-site days	$6,800
A guarded site (lobby security, turnstiles, encrypted badges) or two nearby sites	Up to five on-site days, one after-hours attempt	$10,500
Three or more sites, a campus, or a covert multi-week engagement	Built around your objective	Quoted, fixed before work

These are New York metro prices (see New York penetration testing). Sites outside the New York metro are quoted; kickoff to report usually takes 3-5 weeks. Add an internal network test (from $6,000) or wireless testing (from $3,800). Physical entry as one route to a single objective is a red team, from $12,500; see red teaming vs penetration testing and the types of penetration testing. Every tier is on the physical penetration testing pricing page; send your sites and objectives through the scoping questionnaire for a fixed price.

Frequently asked questions

How much does a physical security assessment cost? A self-assessment costs staff time, and CISA’s SAFE walkthrough is free for low-security sites. Our physical penetration test starts at $6,800 for one NYC-metro office, fixed in writing, with a free re-check of fixed controls.

What are the 5 D’s of physical security? Deter, detect, deny, delay and defend (some versions say respond): an industry shorthand, not a standard, for what each security layer should do.

What are examples of physical security controls? Fences, lighting, locks, badge readers, mantraps, visitor management, cameras, intrusion alarms and guards, plus procedures such as escorting visitors and revoking leavers’ badges the same day.

How often should you do a physical security assessment? Once a year, and after an office move, renovation, badge system change or incident, with access reviews in between.

What authorization does a physical penetration test need? Written authorization signed by someone with authority over the premises, carried by the operators on site, plus written rules of engagement. In a multi-tenant building the landlord must consent as well, and a colocation facility cannot be tested without the operator’s written consent. A tenant cannot authorize entry to space it does not control.

What is tailgating and how do you test for it? Tailgating is following an authorized person through a controlled door without presenting a credential of your own. Test it with management sign-off by having someone staff do not recognize follow them in at the busiest door and time of day, then check whether anyone challenged or reported it and whether the access control log shows one badge for two entries.

Can you test our data center? Yes, your own server rooms and any data hall you control, priced in writing first. A colocation facility needs the operator’s written consent; otherwise their audit report is your evidence.

The short version

Run the 50 checks, verify each by testing, and fix the controls guarding your most valuable rooms first. A physical penetration test then proves they hold, from $6,800 for one NYC-metro office, fixed in writing, with a free re-check: scope yours here.