Physical Security

⚙️ Security Rules

MUST Requirements

Physical security controls you MUST implement:

1. 🏠 Workspace Security

   home_office_requirements:
     dedicated_workspace: required
     lockable_door: recommended
     window_security: blinds_or_curtains_required
     visitor_visibility: minimize_screen_visibility
     secure_storage: lockable_cabinet_or_drawer
     backup_media: fireproof_safe_or_offsite_storage
   

2. 💻 Equipment Protection

   device_security:
     laptops:
       - physical_lock_cable: when_in_public_spaces
       - full_disk_encryption: mandatory
       - screen_privacy_filter: recommended_for_sensitive_work
       - automatic_screen_lock: 5_minutes_idle_maximum
       - boot_password: BIOS/UEFI_password_required
     
     mobile_devices:
       - screen_lock: biometric_or_strong_PIN
       - device_encryption: mandatory
       - remote_wipe_capability: enrolled_in_MDM
       - physical_protection: use_protective_case
     
     storage_media:
       - encryption: all_removable_media_encrypted
       - labeling: classification_labels_applied
       - secure_storage: locked_cabinet_when_not_in_use
       - disposal: secure_wipe_or_physical_destruction
   

3. 🌡️ Environmental Controls

   environmental_protection:
     fire_safety:
       - smoke_detectors: installed_and_tested_monthly
       - fire_extinguisher: accessible_and_inspected
       - evacuation_plan: documented_and_practiced
       - electrical_safety: no_overloaded_circuits
     
     water_damage:
       - equipment_placement: elevated_off_floor
       - leak_detection: water_sensors_near_equipment
       - backup_protection: waterproof_bags_for_critical_items
     
     climate_control:
       - temperature_range: 15-25°C_optimal
       - humidity_control: 30-60%_relative_humidity
       - ventilation: adequate_airflow_for_equipment
   

4. 🧹 Clean Desk/Screen Policy

   information_protection:
     end_of_day:
       - lock_sensitive_documents: secure_cabinet_or_safe
       - secure_removable_media: encrypted_and_locked_away
       - log_out_of_systems: all_sessions_terminated
       - screen_lock: automatic_lock_enabled
       - shred_confidential_waste: cross_cut_shredder
     
     during_work:
       - minimize_paper: digital_first_approach
       - classify_documents: apply_classification_labels
       - visitor_awareness: hide_sensitive_information
       - screen_positioning: away_from_windows_and_visitors
   

5. 👥 Visitor Management

   home_office_visitors:
     before_visit:
       - schedule_visitors: avoid_overlap_with_sensitive_work
       - prepare_workspace: secure_all_confidential_materials
       - screen_positioning: ensure_no_visibility_of_work
     
     during_visit:
       - lock_screens: all_devices_locked
       - escort_required: visitor_never_left_alone_in_workspace
       - conversation_awareness: avoid_discussing_confidential_matters
     
     after_visit:
       - verify_security: check_all_devices_and_documents_secure
       - access_review: review_system_access_logs_if_visitor_near_devices
   

MUST NOT Prohibitions

Physical security practices you MUST NOT do:

1. ❌ Equipment Exposure

   prohibited_practices:
     - leave_devices_unlocked: in_public_or_shared_spaces
     - work_in_public: with_sensitive_data_visible_to_others
     - store_devices_visibly: in_vehicles_or_unsecured_locations
     - share_workspace: with_unauthorized_individuals_during_sensitive_work
     - leave_doors_unlocked: when_workspace_contains_business_equipment
   

2. ❌ Information Exposure

   prohibited_behaviors:
     - print_unnecessary_documents: use_digital_workflows_instead
     - leave_documents_unattended: always_secure_or_destroy
     - discuss_confidential_matters: in_public_or_with_visitors_present
     - dispose_unsecurely: regular_trash_for_sensitive_documents
     - store_passwords_physically: written_passwords_in_visible_locations
   

3. ❌ Unsafe Practices

   dangerous_behaviors:
     - overload_circuits: multiple_high_power_devices_on_one_outlet
     - block_exits: equipment_blocking_emergency_egress
     - ignore_alarms: smoke_detector_or_security_system_alerts
     - disable_protection: removing_security_cables_or_locks
     - unsecured_backup_media: leaving_backup_drives_visible_or_unlocked
   

💡 Examples

Example 1: Home Office Setup (Compliant)

Scenario: Setting up a secure home office workspace for cybersecurity consulting work.

# Home Office Security Configuration
workspace_security:
  location:
    room: dedicated_home_office
    door: lockable_from_inside
    windows:
      - privacy_film_applied: true
      - blinds_installed: true
      - desk_positioned: perpendicular_to_window
  
  equipment:
    primary_workstation:
      device: Ubuntu_22.04_LTS_laptop
      security:
        - full_disk_encryption: LUKS_enabled
        - BIOS_password: configured
        - physical_lock_cable: attached_to_desk
        - screen_privacy_filter: installed
    
    monitors:
      count: 2
      positioning: facing_away_from_door_and_windows
      privacy: screen_not_visible_from_hallway
    
    mobile_devices:
      - iPhone_with_MDM: biometric_lock_enabled
      - iPad: encrypted_and_screen_locked
  
  storage:
    secure_cabinet:
      type: lockable_metal_filing_cabinet
      contents:
        - backup_drives: encrypted_USB_drives
        - client_contracts: physical_copies_locked
        - hardware_tokens: YubiKeys_secured
    
    fireproof_safe:
      contents:
        - critical_backups: offline_encrypted_backups
        - emergency_contacts: printed_emergency_procedures
  
  environmental:
    fire_protection:
      - smoke_detectors: 2_units_tested_monthly
      - fire_extinguisher: ABC_rated_inspected_annually
    
    climate_control:
      - temperature: thermostat_set_20°C
      - humidity: dehumidifier_maintains_45%_RH
    
    power_protection:
      - UPS: 1500VA_battery_backup_for_workstation
      - surge_protection: all_devices_on_surge_protectors

  clean_desk_policy:
    daily_routine:
      - end_of_day: all_documents_locked_in_cabinet
      - screen_lock: automatic_after_5_minutes
      - shredding: cross_cut_shredder_for_sensitive_waste

Result: ✅ Compliant - Comprehensive physical security controls for home office

ISO 27001:2022 Mapping:

• A.7.4: Physical security monitoring
• A.7.9: Security of assets off-premises
• A.7.13: Clear desk and clear screen

Example 2: Visitor Access Control (Compliant)

Scenario: Client visiting home office for project kick-off meeting.

# Visitor Management Procedure
visitor_access_control:
  pre_visit_preparation:
    schedule:
      date: 2026-02-15
      time: 10:00-12:00
      visitor: client_representative
    
    security_actions:
      - review_calendar: no_overlapping_sensitive_work
      - secure_materials:
          - lock_client_contracts: all_other_clients_secured
          - close_applications: client_systems_logged_out
          - position_screens: face_away_from_guest_seating
      - prepare_meeting_area:
          - clean_desk: no_documents_visible
          - lock_cabinets: filing_cabinet_secured
          - test_screen_lock: automatic_lock_verified
  
  during_visit:
    physical_controls:
      - workspace_access: visitor_not_allowed_in_office_area
      - meeting_location: living_room_separate_from_workspace
      - screen_status: all_devices_locked_before_meeting
      - door_closed: office_door_closed_and_locked
    
    behavioral_controls:
      - conversation_topics: project_scope_only_no_other_clients
      - document_handling: only_visitor_specific_materials_shown
      - device_access: visitor_devices_not_connected_to_network
      - escort_policy: visitor_escorted_if_bathroom_access_needed
  
  post_visit:
    verification_checklist:
      - physical_security:
          - devices_still_locked: verified
          - documents_secured: filing_cabinet_still_locked
          - no_items_left_behind: workspace_checked
      - access_review:
          - system_logs: no_unauthorized_access_detected
          - network_connections: no_unknown_devices_connected
      - follow_up:
          - meeting_notes: sensitive_details_encrypted
          - next_steps: documented_in_project_tracker

Result: ✅ Compliant - Proper visitor management with information protection

ISO 27001:2022 Mapping:

• A.7.1: Physical security perimeters
• A.7.2: Physical entry
• A.7.13: Clear desk and clear screen

Example 3: Equipment Loss Prevention (Non-Compliant → Corrected)

Scenario: Laptop left unattended in coffee shop while working remotely.

❌ Non-Compliant Practice:

# INCORRECT - Physical Security Violation
coffee_shop_work:
  laptop_security:
    - screen_lock: disabled_for_convenience
    - physical_security: left_on_table_while_ordering_coffee
    - confidential_work: client_contract_visible_on_screen
    - location: public_coffee_shop_with_high_traffic

Problems:

• ❌ Device left unattended in public space
• ❌ Screen lock disabled exposing confidential information
• ❌ No physical security (cable lock) used
• ❌ Sensitive work performed in public location

✅ Corrected Approach:

# CORRECT - Secure Remote Work Practices
remote_work_policy:
  location_assessment:
    - evaluate_sensitivity: client_contract_work_is_HIGH_classification
    - decision: work_from_home_office_only_for_sensitive_tasks
  
  public_space_work:
    allowed_activities:
      - general_research: non_client_specific_industry_research
      - email_review: non_confidential_communications_only
      - code_review: public_open_source_projects_only
    
    required_controls:
      - screen_privacy_filter: prevents_shoulder_surfing
      - VPN_connection: always_enabled_for_business_access
      - screen_lock: automatic_after_2_minutes_in_public
      - physical_security: laptop_never_left_unattended
      - positioning: back_to_wall_screen_not_visible_to_others
    
    prohibited_activities:
      - client_contracts: no_confidential_documents_in_public
      - sensitive_data: no_HIGH_or_CRITICAL_data_access
      - production_systems: no_administrative_access_from_public_wifi
  
  device_protection:
    - physical_lock_cable: attached_when_in_public_spaces
    - screen_lock: automatic_and_immediate_when_leaving_seat
    - backup_awareness: work_saved_to_cloud_before_leaving_home

Result: ✅ Corrected - Appropriate controls for remote work based on data sensitivity

Classification Impact:

• 🔴 Critical/High Data: Work from home office only with full security controls
• 🟡 Medium Data: Public spaces with screen privacy filter and VPN
• 🟢 Low/Public Data: Public spaces with basic security awareness

🔗 Integration Points

ISMS Policy Integration

This skill implements controls from:

• Physical Security Policy - Home office security framework
• Asset Register - Equipment inventory and classification
• Information Security Policy - Overall security framework
• Classification Framework - Data sensitivity levels
• Incident Response Plan - Device loss/theft procedures

Related Security Skills

• cryptography - Encryption requirements for devices and storage media
• data-classification - Information sensitivity and handling requirements
• mobile-device-management - Mobile device security controls
• access-control - Authentication and authorization for devices

Compliance Frameworks

ISO 27001:2022 Controls:

• A.7.1 - Physical security perimeters (home office boundary definition)
• A.7.2 - Physical entry (visitor management and access control)
• A.7.4 - Physical security monitoring (environmental and equipment monitoring)
• A.7.9 - Security of assets off-premises (remote work equipment protection)
• A.7.13 - Clear desk and clear screen (information exposure prevention)
• A.7.14 - Secure disposal or re-use of equipment (secure destruction procedures)

NIST CSF 2.0 Functions:

• PR.AC-01 - Physical access to assets is managed and protected
• PR.DS-01 - Data-at-rest is protected (encrypted storage media)
• PR.IP-06 - Data is destroyed according to policy (secure disposal)
• PR.PT-02 - Removable media is protected (encrypted and secured)

CIS Controls v8.1:

• 1.1 - Establish and maintain detailed enterprise asset inventory (equipment tracking)
• 3.6 - Securely manage enterprise assets and data (physical security controls)
• 10.7 - Use behavior-based anti-malware software (environmental threat detection)
• 12.8 - Define and maintain role-based access control (visitor management)

🎯 Best Practices

Home Office Security Checklist

## Daily Security Routine

**Start of Day:**
- [ ] Verify workspace door is locked
- [ ] Check environmental controls (smoke detector, temperature)
- [ ] Boot devices with BIOS password
- [ ] Verify screen privacy filter is clean and positioned correctly
- [ ] Check UPS battery status

**During Work:**
- [ ] Lock screen when leaving workspace
- [ ] Position screens away from windows and hallways
- [ ] Secure documents immediately after use
- [ ] Shred sensitive waste in cross-cut shredder
- [ ] Escort visitors if they need access to home during work hours

**End of Day:**
- [ ] Log out of all systems
- [ ] Lock all devices with cable locks or in secure storage
- [ ] Secure all documents in lockable cabinet
- [ ] Secure backup media in fireproof safe
- [ ] Verify all windows and doors locked
- [ ] Set alarm system if available

Equipment Protection Matrix

Environmental Monitoring

# Recommended Environmental Sensors
home_office_monitoring:
  fire_detection:
    - smoke_detectors: 2_units_interconnected
    - heat_detectors: 1_unit_above_equipment
    - testing_schedule: monthly_button_test
  
  water_damage:
    - water_sensors: under_AC_units_and_near_windows
    - leak_detection: near_water_heater_if_adjacent
    - alert_method: SMS_notification_to_phone
  
  climate:
    - temperature_sensor: smart_thermostat_with_alerts
    - humidity_sensor: standalone_hygrometer
    - alert_thresholds:
        - temperature: below_15°C_or_above_30°C
        - humidity: below_25%_or_above_70%
  
  power:
    - UPS_monitoring: software_alerts_for_power_events
    - surge_protection: LED_indicators_on_surge_protectors
    - generator: optional_for_critical_infrastructure

📊 Risk Mitigation

Physical Security Threats

Incident Response

Device Loss/Theft:

1. Immediately report to CEO (self-reporting for single-person company)
2. Remote wipe device if MDM capable (see Mobile Device Management Policy)
3. Change all passwords accessed from device
4. Report to police if theft suspected
5. Review access logs for unauthorized activity
6. Update Asset Register

Fire/Water Damage:

1. Ensure personal safety first
2. Contact emergency services if necessary
3. Document damage with photos
4. Recover equipment if safe to do so
5. Assess data recovery options
6. Restore from backups per Backup Recovery Policy
7. File insurance claim if applicable

🔍 Validation & Testing

Physical Security Audit

#!/bin/bash
# Physical Security Self-Assessment Script

echo "🏠 Hack23 AB - Physical Security Audit"
echo "========================================"
echo ""

# Workspace Security
echo "📋 Workspace Security Checklist:"
read -p "Is workspace in a lockable room? (yes/no): " lockable_room
read -p "Are windows covered with blinds/film? (yes/no): " window_privacy
read -p "Is secure storage (cabinet/safe) available? (yes/no): " secure_storage
read -p "Are screens positioned away from windows/doors? (yes/no): " screen_position

# Equipment Protection
echo ""
echo "💻 Equipment Protection Checklist:"
read -p "Are laptops using full disk encryption? (yes/no): " disk_encryption
read -p "Are cable locks used for equipment? (yes/no): " cable_locks
read -p "Are mobile devices enrolled in MDM? (yes/no): " mdm_enrolled
read -p "Is automatic screen lock enabled (<5 min)? (yes/no): " screen_lock

# Environmental Controls
echo ""
echo "🌡️ Environmental Controls Checklist:"
read -p "Are smoke detectors installed and tested? (yes/no): " smoke_detectors
read -p "Is fire extinguisher accessible and inspected? (yes/no): " fire_extinguisher
read -p "Is equipment elevated off floor? (yes/no): " elevated_equipment
read -p "Is UPS/surge protection installed? (yes/no): " power_protection

# Clean Desk Policy
echo ""
echo "🧹 Clean Desk Policy Checklist:"
read -p "Are documents locked at end of day? (yes/no): " documents_secured
read -p "Is cross-cut shredder available? (yes/no): " shredder_available
read -p "Are backup media secured in safe/cabinet? (yes/no): " backup_secured

# Calculate compliance score
score=0
total=13

[[ "$lockable_room" == "yes" ]] && ((score++))
[[ "$window_privacy" == "yes" ]] && ((score++))
[[ "$secure_storage" == "yes" ]] && ((score++))
[[ "$screen_position" == "yes" ]] && ((score++))
[[ "$disk_encryption" == "yes" ]] && ((score++))
[[ "$cable_locks" == "yes" ]] && ((score++))
[[ "$mdm_enrolled" == "yes" ]] && ((score++))
[[ "$screen_lock" == "yes" ]] && ((score++))
[[ "$smoke_detectors" == "yes" ]] && ((score++))
[[ "$fire_extinguisher" == "yes" ]] && ((score++))
[[ "$elevated_equipment" == "yes" ]] && ((score++))
[[ "$power_protection" == "yes" ]] && ((score++))
[[ "$documents_secured" == "yes" ]] && ((score++))
[[ "$backup_secured" == "yes" ]] && ((score++))

compliance_percentage=$((score * 100 / total))

echo ""
echo "========================================"
echo "📊 Compliance Score: $score/$total ($compliance_percentage%)"
echo ""

if [ $compliance_percentage -ge 90 ]; then
    echo "✅ EXCELLENT - Physical security controls are comprehensive"
elif [ $compliance_percentage -ge 70 ]; then
    echo "⚠️  GOOD - Minor improvements needed"
elif [ $compliance_percentage -ge 50 ]; then
    echo "⚠️  FAIR - Significant gaps exist, immediate action required"
else
    echo "❌ POOR - Critical physical security deficiencies"
fi

echo ""
echo "📝 Document findings in Security Metrics and Asset Register"
echo "🔄 Schedule remediation for any 'no' responses"

Monthly Security Review

## Physical Security Monthly Review Checklist

**Date:** [YYYY-MM-DD]  
**Reviewer:** CEO

### Equipment Inventory
- [ ] Verify all devices in Asset Register are accounted for
- [ ] Check encryption status on all laptops and storage media
- [ ] Test screen locks and BIOS passwords
- [ ] Inspect cable locks for damage or tampering
- [ ] Verify mobile device MDM enrollment status

### Environmental Systems
- [ ] Test smoke detectors (button test)
- [ ] Inspect fire extinguisher pressure gauge
- [ ] Check UPS battery status and runtime test
- [ ] Test water sensors if installed
- [ ] Review climate control (temperature/humidity logs)

### Workspace Security
- [ ] Verify lockable cabinet is functional
- [ ] Inspect fireproof safe for damage
- [ ] Check window coverings for damage or gaps
- [ ] Assess screen positioning for visitor visibility
- [ ] Review clean desk policy compliance

### Visitor Management
- [ ] Review visitor log (if any visits occurred)
- [ ] Assess visitor access procedures effectiveness
- [ ] Update visitor management procedures if needed

### Remediation Actions
- [ ] Document any deficiencies found
- [ ] Assign remediation tasks with deadlines
- [ ] Update Asset Register with any changes
- [ ] Schedule next monthly review

🎓 Training & Awareness

Physical Security Principles

Layered Protection Approach:

1. Perimeter Security: Home office boundary (locked doors, windows secured)
2. Equipment Security: Device locks, encryption, screen privacy
3. Information Security: Clean desk policy, secure disposal, classification awareness
4. Environmental Security: Fire/water/climate protection
5. Behavioral Security: Visitor awareness, situational awareness, incident reporting

Security Culture:

• Physical security is everyone's responsibility (even in single-person company)
• "If you see something, say something" applies to physical threats too
• Security controls are not obstacles—they protect business continuity
• Transparency in security practices demonstrates professional maturity

Resources

• Physical Security Policy: View on GitHub
• Asset Register: View on GitHub
• ISO 27001:2022 A.7: Physical and environmental security controls
• NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems

📋 Document Control

Skill Metadata:

• Version: 1.0
• Last Updated: 2026-02-10
• Review Cycle: Annual
• Owner: Hack23 AB Security Team
• Classification:

Framework Compliance:

License: Apache-2.0
Repository: https://github.com/Hack23/homepage