Physical security is the set of controls that protect facilities, hardware, and people from tangible threats like forced entry, theft, vandalism, environmental damage, and espionage. The point that candidates sometimes underrate: an attacker who reaches your server room can sidestep nearly every logical control you built, so physical measures are not a lesser layer.
Good programs work in concentric rings. Perimeter controls such as fencing and lighting mark the outer edge, entry controls decide who gets into the building, interior controls guard high-value rooms, and environmental controls handle power, fire, flooding, and temperature. A common blind spot is the loading dock or a propped side door, where expensive front-of-house controls quietly get bypassed. Deterrence, detection, delay, and response should reinforce each other rather than stand alone.
Why does physical security matter for the CISSP exam?
Site and facility design controls sit squarely in Domain 3: Security Architecture and Engineering, and their day-to-day operation also touches Domain 7. You should know control categories, principles like Crime Prevention Through Environmental Design, environmental threat mitigation, and how physical and logical access controls depend on one another.
Related terms: Security Control, Access Control