Physical Security Lifecycle Management Series – Audit

Part five of our five-part series discussing SiteOwl’s Lifecycle Management Framework.

Physical security is front and center in the minds of most organizations, but while the latest technologies get much attention, auditing is often an afterthought. Still, with accurate information and a plan, you can conduct regular audits to get the most out of your physical security systems.

In this article, we’ll answer some of the most common questions security teams have about conducting physical security audits.

Table of Contents

• What is a Physical Security Systems Audit?
• What information will make the audit process easier?
• How do you conduct a physical security audit?
• What areas should you focus on during a physical security audit?
• How many times should you perform a physical security audit?
• What technologies can you use to support your physical security audit?
• How to use the results of a physical security audit?
• What are some references for conducting a physical security audit?

1. What is a Physical Security Systems Audit?

A physical security audit reviews systems, devices, and procedures to make sure they operate properly and align with your security objectives. The goal of the audit is to identify vulnerabilities and gaps in your physical security infrastructure and determine the best ways to mitigate them.

Here are three areas that a physical security systems audit focuses on: 

• Systems- The goal is to make sure security systems are installed and configured properly, meet standards, and perform as designed. For example, if your physical security risk assessment shows that intrusion detection is a high risk. You should prioritize it in your physical security systems audit to identify security gaps.
• Devices – To ensure security devices are functional and working as intended. This includes security solutions such as surveillance cameras, access control readers, and other physical security devices that support your security plan and address potential threats.
• Procedures – To verify security procedures are written and implemented as intended. For example, security staff should have the tools and training to check systems in real-time and conduct audits without relying on paper or manual processes.

Ultimately, a physical security audit should empower you and your team with actionable insights to improve security operations and protect your organization.

2. What information will make the audit process easier?

It’s best to have a clear picture of your current infrastructure before starting the audit. It’s best to have a clear picture of your current infrastructure before starting the audit. Ideally, you want a complete view of what’s installed, exact location, condition, and operating procedures. Having this information in a central platform can make the process smoother.

What information should you have before conducting a physical security audit?

• Updated Physical Risk Assessment: This is a must-have because you need to know your security threats, vulnerabilities, and potential opportunities within your current infrastructure before you start.
• Asset Inventory: A complete inventory of your physical assets, including their location, condition, and warranty information, will help you assess risks and plan your audit accordingly. With an accurate inventory, you can easily plan for upgrades and adjust your posture depending on your security needs to minimize downtime. 
• Security system documentation:  A list of your security systems and the documentation that describes how they work. This is key, especially when managing multiple systems, sites, and vendors.
• Updated System logs: If possible, you should also have a list of your security system logs, including when they were last updated. For example, the update frequency for security cameras varies based on age, security requirements, and budget. Generally, it is advisable to update them every 3-5 years as a general rule of thumb.
• Standards and guidelines: It’s a good idea to review your standards and guidelines even as a refresher before conducting an audit.

Download – Free Security Risk Self-Assessment Document

3. How do you conduct a physical security audit?

Conducting a physical security audit takes preparation and coordination. While there are clear best practices and steps to follow, there’s no one-size-fits-all. Depending on your organization’s size, internal security team, and the scope of your audit, there are several different ways you can approach the process.

Three common methods for conducting a physical security audit are:

• Internal Security Team: If you have an internal security team, you may want to use more of a collaborative approach where you’re coordinating and delegating tasks on a timescale that works for your team and organization. 

• External/Integrator Approach: If you have a great relationship with your physical security integrator, you may want to outsource the entire audit and allow your integrator to handle the evaluation while you focus on the implementation.
• Hybrid model: Some organizations may want to conduct an audit independently and then use a third-party integrator to help with implementation. The audit is a great place to start because it gives you a baseline and helps you identify areas of opportunity.

4. What areas should you focus on during a physical security audit?

As mentioned in the previous question, there really isn’t a single template for a physical security audit. However, there are some common areas to focus on after you have defined objectives and gathered your information. 

Areas to review during a physical security audit can be divided into three main categories:physical security infrastructure and systems, people and processes, and organization and culture. How you approach these areas will depend on your approach and the objectives you have defined, but key physical security areas that you must evaluate include:

• Physical Perimeter: Evaluate the physical perimeter of the facility, including fences, gates, walls, windows, doors, locks, access control systems, and other safeguards in place. Identify potential vulnerabilities, such as weak points, damaged barriers, or unauthorized access points.
• Access Control: Review the access control systems, including key cards, badges, biometric systems, or any other mechanisms in place. Verify if access control policies are being followed and check for any weaknesses or gaps in the system.
• Surveillance Systems: Inspect the surveillance systems, including CCTV cameras, alarms, motion sensors, and video recording equipment. Ensure they function correctly, covering critical areas and providing adequate visibility. Check for blind spots or any equipment malfunctions.
•  Alarm Systems: Review the alarm systems installed, such as intrusion alarms, fire alarms, and panic alarms. Test their functionality and assess their responsiveness. Check if they are appropriately connected to monitoring services or security personnel.
• Security Lighting: Evaluate the lighting conditions inside and outside the facility. Ensure all critical areas are well-lit, including entrances, parking lots, walkways, and vulnerable spots. Identify any areas with inadequate lighting that may pose a security risk.

Remember that the specific steps and considerations may vary depending on the nature of your facility, industry regulations, and organizational requirements.

5. How many times should you perform a physical security audit?

Generally, conducting a yearly physical security audit is sufficient. However, the frequency may vary depending on the nature of your industry and other factors. For example, warehouses typically have a higher risk of burglary, so they should be audited more often than office buildings.

Audits are not meant to replace your ongoing lifecycle management efforts. Rather, they provide an opportunity to assess how well your physical security program is performing and identify opportunities for improvement. Platforms like SiteOwl enable you to conduct system-wide audits regularly with a few clicks of a button.

6. What technologies can you use to support your physical security audit?

With so much to cover in a single audit, you’re going to need a tool to keep track of everything. A common mistake security teams make is to rely on spreadsheets, which are inherently inefficient and error-prone. Instead, you should rely on a central repository of data that gives you the visibility you need to monitor your physical security program from start to finish. 

The average facility has about 100 physical security devices and sensors. Without a centralized platform to analyze the information gathered during the audit, you’ll risk missing important details or misinterpreting data.

Lifecycle management platforms like SiteOwl allow you to collect, organize, and analyze your data in a centralized location. This eliminates the need to manually track and store information and puts you in control of your data.

7. How to use the results of a physical security audit?

After putting in all the hard work, you want to be able to see the results of your efforts. The results of your physical security audit will provide you with valuable insights into how well your physical security program is performing.

The worst mistake is to do nothing with the results of your audit. You can use the key findings to improve your processes and preventative maintenance program. With SiteOwl, you can easily access your audit results from a centralized dashboard and take action on them.

Explore SiteOwl

8. What are some references for conducting a physical security audit?

Solid references with best practices and industry standards will help you conduct your audit in a structured manner. This is especially true if you’re conducting an audit for the first time or will be auditing a new physical security system.

Here are some commonly recognized references that can provide valuable guidance:

• ASIS International: ASIS International is a leading organization for security professionals, and they offer various resources related to physical security. Their publications, such as the “Physical Security Professional (PSP) Study Guide” and “Protection of Assets (POA) Reference Set,” provide comprehensive information and best practices for physical security audits.
• International Organization for Standardization (ISO): ISO has developed standards related to physical security that can serve as references for conducting audits. ISO 27001 focuses on information security management systems, including physical security aspects. ISO 27002 provides guidelines for implementing security controls, including physical security measures.
• The National Institute of Standards and Technology (NIST): NIST, a U.S. federal agency, offers various publications that can help conduct physical security audits. The “NIST Special Publication 800-53: Security and Privacy Controls for Federal Information Systems and Organizations” provides a comprehensive set of security controls that can be adapted to physical security requirements.

In addition to the references mentioned above, we put together a practical guide for enterprise security teams that covers virtually every aspect of managing a physical security program, from audits to lifecycle management.

Download eBook – Managing-The Lifecycle Of Physical Security Systems

Final Thoughts

Physical security audits are challenging, necessary, and rewarding. The steps in this article can help you start your audit process and ensure that you are asking the right questions. 

Regardless of your approach, remember that a physical security audit is the first step in establishing a strong physical security program, and SiteOwl is here to help you achieve your goals.

Want to learn more? Download our free eBook: Managing The Lifecycle Of Physical Security Systems, a practical guide for enterprise security teams to plan, deploy, and manage security systems with confidence!