Physical Security — CISSP Study Guide

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

The functional chain: deter, deny, detect, delay, respond
Perimeter controls: working the boundary inward
Internal controls: locks, credentials, and intrusion sensors
Tailgating, mantraps, and turnstiles
Exam-pattern recognition

Physical controls by function in the deter→deny→detect→delay→respond chain

Control	Primary function(s)	What it does	Defeated by / limit
Fencing / walls	Deter, deny, delay	Mark the boundary and physically obstruct entry; height and gauge set the delay (a determined climber is only delayed, not stopped)	Cutting, climbing, or going over/under given enough time; deters casual, delays determined
Bollards / gates	Deny, delay	Stop or channel vehicle approach and force pedestrians through controlled points	Do not address a person on foot once past the vehicle line
Lighting	Deter, detect	Make the approach visible so cameras and guards can observe and intruders feel exposed	Provides no barrier; only supports surveillance
CCTV / video surveillance	Detect, deter (if visible)	Records and lets a guard observe; visible cameras also deter	Records, does not stop; needs a monitor or review to act (a passive detective control)
Security guards (and dogs)	Deter, detect, delay, respond	The only control that exercises judgment, challenges, and responds; provides surveillance where cameras do not reach	Costly, fatigue/inconsistency, life-safety and liability risk; dogs add unpredictable deterrence and patrol
Access-control vestibule (mantrap) / turnstile	Deny	Enforce one-person-per-authorization passage, directly defeating tailgating/piggybacking	Throughput and emergency-egress constraints; vestibule must release for life safety
Locks (mechanical / electronic / biometric)	Deny, delay	Authenticate authority to open a door; a lock's rating sets how long it delays a determined attacker	Picking, bypass, lost keys/combinations (re-key on transfer/termination)
Badges / proximity / smart cards	Deny	Present a credential to a reader that grants or denies and logs the entry	Lost/cloned cards; logs one entry while tailgating admits two people
Motion / contact / glass-break sensors + alarm	Detect	Sense unauthorized presence or breach and trigger an alarm and response	Detective only: does not block; depends on a monitored, timely response

Cheat sheet

Every physical control serves one of five functions: deter, deny, detect, delay, respond
CCTV detects and (if visible) deters, but never denies: it stops no one
A security guard is the only physical control that exercises judgment and responds
A fence only deters and delays: given time and tools, any fence is defeated
Bollards and vehicle barriers address the vehicle threat a fence alone does not
Lighting is a deterrent and a detection enabler, not a barrier
Lay out a facility as concentric zones of decreasing public access
No access-control device stops tailgating: it is an enforcement gap, not a device failure
An access-control vestibule (mantrap) enforces single-person passage
Full-height turnstiles enforce one-person passage; optical turnstiles only detect it
A lock is a deny-and-delay control, never absolute: its rating sets the delay
Re-key locks and change combinations when a key/combination holder leaves or it is compromised
Electronic locks let you grant, revoke, schedule, and log access centrally without re-keying
A proximity card is read wirelessly; a smart card carries a chip and resists cloning
A reader grants on the credential, not the person, so it logs one entry even when two enter
Motion, contact, and glass-break sensors detect intrusion: they never deny it
Intrusion alarms work in conjunction with barriers, access control, and guards
Escort visitors and keep visitor access records as procedural reinforcement
Fire, HVAC, power, and siting are facility-engineering, not perimeter/internal access controls
Human life outranks every asset: egress fails safe (unlocked) when people are inside

Unlock with Premium — includes all practice exams and the complete study guide.

References

NIST SP 800-53 Rev. 5: Security and Privacy Controls (Physical and Environmental Protection, PE family) Whitepaper