Skip to content
FR

Physical Security, Facilities, and System Lifecycle

Step 19 of 38

CISSP Physical Security: Facilities, Fire Protection, and System Lifecycle

Introduction

CISSP physical security connects site selection, access controls, environmental protection, and secure system retirement. This lesson covers tasks 3.8, 3.9, and 3.10 of Domain 3, Security Architecture and Engineering (13% of the exam, ISC2 exam outline effective 15 April 2024): select and implement secure design for sites and facilities, implement site and facility security controls, and manage the information system lifecycle. It closes Domain 3.

Physical security is the base of every other control: an intruder who steals a server can disrupt availability and attack the device offline. Properly implemented encryption at rest still protects confidentiality; physical and logical controls complement each other. The exam favors layered, risk-based physical design, life-safety first, and an understanding of how to build security into every phase of a system's life, from requirements to retirement.

Learning objectives

After this lesson you can:

  1. Apply Crime Prevention Through Environmental Design (CPTED) and layered physical security to a site.
  2. Choose controls for wiring closets, server rooms, media storage, and evidence storage.
  3. Select and justify utilities controls: power, HVAC, water, and fire detection and suppression.
  4. Distinguish preventive, detective, deterrent, and compensating physical controls and select appropriate barriers, locks, lighting, and surveillance.
  5. Explain visitor, delivery, and personnel controls such as mantraps and badge policies.
  6. Describe the phases of the information system lifecycle and the security activities in each.
  7. Explain secure disposal and retirement, including media sanitization.

1. Site selection and facility design

Security starts when the site is chosen, because it is expensive to retrofit.

1.1 Site selection factors

  • Natural hazards: floodplains, seismic zones, hurricane or tornado exposure, wildfire.
  • Man-made hazards: proximity to airports, chemical plants, highways, railways, or high-crime areas.
  • Visibility: a data center with prominent branding attracts attention. Low-profile sites are preferred.
  • Utilities and access: multiple power feeds and network providers, road access for emergency services, and distance from other tenants with different risk profiles.
  • Neighbors and shared buildings: shared walls or ceilings, common lobbies, and cleaning contractors increase exposure.
  • Legal and regulatory fit: zoning, data residency, building codes.

1.2 CPTED

Crime Prevention Through Environmental Design uses the physical environment to reduce crime. Its principles:

Principle Idea Example
Natural surveillance Make activity easy to see Windows facing parking, good lighting, no hiding places, low landscaping
Natural access control Guide people to controlled entrances One main entrance, walkways, bollards, fences
Territorial reinforcement Show ownership so intruders feel observed Signage, defined boundaries, maintained property
Maintenance Neglect signals low risk of being caught Repair broken lights and fences quickly

1.3 Layered defense (defense in depth) in physical form

Think of concentric zones: perimeter (fence, gates, lighting, bollards), building exterior (doors, windows, roof), interior (reception, corridors, departments), and secure areas (data center, vault, evidence room). Each layer deters, detects, delays, and responds. The classic sequence is deter, detect, delay, respond; delay is what gives responders time to arrive, so a detection system without a delay or response capability is incomplete.

2. Perimeter and entry controls

2.1 Barriers

Control Notes
Fences Select height, material, anti-climb features, and foundations from the threat assessment and applicable safety rules; no single height guarantees protection
Bollards Rated vehicle barriers selected for impact conditions, spacing, and foundations; decorative posts are not necessarily crash-rated
Gates Classes by usage and speed; use vehicle barriers and anti-tailgating
Walls and doors Solid-core or steel doors, reinforced frames and hinges on the secure side; windows with laminated glass in sensitive rooms
Mantrap (airlock, access control vestibule) Two interlocked doors; the second opens only after the first closes. Can reduce tailgating and piggybacking with suitable occupancy detection, authentication, monitoring, and safe egress
Turnstiles Allow one person per authentication

2.2 Lighting and surveillance

  • Lighting deters and enables observation; coverage must match camera needs and avoid glare and dark pockets.
  • CCTV is a deterrent and detective control and supports investigations. Use adequate resolution, retention aligned with policy and privacy law, protected storage, and time synchronization. Cameras without monitoring or response produce evidence after the fact; they do not stop the intrusion.
  • Guards provide judgment and response and can verify identity; they are costly and vary in reliability. Guard dogs detect and deter but raise safety and liability issues.

2.3 Locks and credentials

Type Comment
Mechanical key lock Keys can be copied; rekeying is expensive
Combination/keypad Codes shared or shoulder-surfed
Electronic card or badge Allows central management, logs, and revocation subject to controller connectivity and cache behavior; pair with a second factor for sensitive areas
Biometric Strong linking to the person; consider privacy, accuracy (FAR, FRR), and spoofing
Smart lock with MFA Combine card and PIN for data centers

Master key and key control: record key issue, restrict duplication, and rotate when employees leave. Anti-passback tracks entry/exit state and can deny or flag repeated entry; effectiveness depends on configuration, shared state, and handling of exceptions. Tailgating (following an authorized person without their knowledge) is reduced by properly configured vestibules, turnstiles, guards, and awareness training. Piggybacking is following with the authorized person's knowledge or cooperation.

2.4 Intrusion detection

Sensors: door contacts, glass-break detectors, motion sensors (passive infrared, microwave, ultrasonic), vibration sensors, and perimeter fence sensors. Alarms must be monitored and tied to a defined response (guard dispatch, police). Test regularly, secure alarm communications, and plan for false alarms.

3. Internal areas: wiring closets, server rooms, media, and evidence storage

3.1 Wiring closets and distribution rooms

Wiring closets hold patch panels, switches, and cabling. Risks: unauthorized access allowing sniffing or rogue devices, sabotage, and unlabeled or tampered cables. Controls: locked rooms with logged access, no shared use with janitorial supplies, tamper-evident seals, cable management with labeling, port security on switches, and physical protection for cable runs (conduit). Fiber is harder to tap than copper; shielded cable reduces emanation leakage and interference.

3.2 Server rooms and data centers

  • Location: inside the building core, away from exterior walls, plumbing, and public corridors; above flood levels, with no windows.
  • Construction: slab-to-slab walls so no one can enter above a drop ceiling or under a raised floor.
  • Access: multifactor (badge plus PIN or biometric), mantrap, visitor escort, access logging, and periodic review of the access list.
  • Monitoring: cameras inside and at entrances, environmental sensors (temperature, humidity, water).
  • Clear separation of zones: staging, operations, and critical equipment areas.
  • Rules: no unapproved media, cameras, or equipment brought in or out.

3.3 Media storage

Backup tapes, drives, and paper hold complete data sets. Store them in locked, fire-rated safes or vaults, preferably at an offsite location far enough away to avoid the same disaster, with inventory, check-in and check-out logs, and encryption. Protect transit with sealed containers and tracked courier procedures.

3.4 Evidence storage

Evidence rooms must support the chain of custody (Lesson 16): restricted access, logging of every entry, individually sealed and labeled evidence bags, locked containers, controlled temperature for sensitive media, and separation from general storage. Gaps in custody can make evidence inadmissible.

3.5 Work areas and secure rooms

Use clean desk policies, privacy screens, secured printers, and shredding. For highly sensitive discussions, a secure compartmented room may need soundproofing, white noise, and controls against electronic emanations. TEMPEST shielding addresses compromising emanations; a Faraday enclosure attenuates electromagnetic signals within its designed frequency range; seams, penetrations, grounding, and installation matter.

Worked example 1: choosing controls for a server room.

Scenario. A mid-sized company moves its servers into a spare room on the ground floor. The room has an exterior window, a drop ceiling shared with the corridor, a standard key lock, and a water pipe running overhead. The business wants an affordable improvement plan.

Reasoning, step by step.

  1. The window and exterior wall expose the room to forced entry and observation: remove or replace the window with a solid wall, or relocate to an interior room.
  2. The shared drop ceiling lets an intruder climb over the wall: extend walls slab to slab.
  3. A standard key lock gives no accountability: install badge access with PIN and logs.
  4. Overhead water pipe: relocate or install leak detection and a drip tray, because water damage is a common cause of outages.
  5. Add temperature and humidity sensors and an alarm; provide gas-based or pre-action fire suppression.

Solution. Interior location or hardened walls, slab-to-slab construction, multifactor logged access, water mitigation, environmental monitoring, and suitable suppression.

Why other priorities are weaker. Adding more cameras without fixing the ceiling gap records the intruder but does not prevent entry. A guard at the corridor does not address water or fire. Stronger encryption does not stop physical theft of the hardware, though it protects the data on it.

4. Utilities and environmental controls

4.1 Power

Threat Description Control
Blackout Total loss of power UPS plus generator
Brownout/sag Sustained low voltage Line conditioner, UPS
Surge/spike Brief high voltage Surge protector, UPS
Noise (EMI/RFI) Interference Shielding, filters, proper grounding
Inrush Initial high current Power sequencing

A UPS bridges an interruption for its rated load and battery runtime; a generator can provide longer operation after startup, subject to fuel, cooling, maintenance, and transfer-system reliability. Test them on schedule and maintain fuel contracts. Use redundant power feeds, separate circuits, and dual power supplies (the "A/B" design). Design for N+1 redundancy for critical components.

4.2 HVAC, temperature, and humidity

ASHRAE's 2021 recommended inlet-temperature range for air-cooled equipment classes A1–A4 is 18–27 degrees C (64–81 degrees F); it is not a universal limit for every equipment class or cooling design. Set humidity from the manufacturer's and applicable ASHRAE limits, considering dew point, relative humidity, and contamination. Dry conditions increase electrostatic-discharge risk; condensation occurs when a surface is below the air's dew point. High moisture can promote corrosion. A fixed 40–60 percent rule is not universally required. Use hot-aisle/cold-aisle layouts, redundant cooling, monitored sensors, and a dedicated HVAC for sensitive rooms. Positive air pressure keeps dust out. Fire dampers prevent smoke traveling through ducts.

4.3 Water and flooding

Keep the room away from water sources, install leak detectors under raised floors, and protect with drains and sump pumps. Locate equipment above the flood level.

4.4 Fire prevention, detection, and suppression

Prevention: fire-rated construction, no combustible storage, electrical maintenance, and housekeeping.

Detection: smoke (ionization or photoelectric), heat (fixed temperature or rate-of-rise), flame detectors, and very early smoke detection apparatus (VESDA) that samples air.

Fire classes (US):

Class Fuel Suppression
A Common combustibles (wood, paper) Water, foam
B Flammable liquids Gas agents, CO2, foam, dry chemical
C Energized electrical equipment Use appropriately rated portable agents; avoid ordinary water application by personnel while energized. Installed automatic protection is selected under applicable codes
D Combustible metals Dry powder
K Cooking oils Wet chemical

Water sprinkler systems:

Type Behavior Use
Wet pipe Pipes always hold water; head opens when heated General areas; fastest but leaks can damage equipment
Dry pipe Pipes hold air; water enters when a head fires Cold areas where freezing is possible
Pre-action Single-interlock detection admits water to piping; an open sprinkler discharges it. Double-interlock requires both detection and sprinkler operation before admission Consider for water-damage-sensitive spaces; match the variant and design to code
Deluge All heads open together High-hazard areas

Gas suppression: listed clean-agent systems, including appropriate inert gases or halocarbon agents, leave little or no residue. Select agents against current environmental rules, supply, servicing, and occupancy constraints. Older product examples need review: 3M completed its PFAS-manufacturing exit at the end of 2025, so do not assume continued new manufacture of its Novec 1230 product. Halon production was phased out because of ozone depletion; rules for existing stocks and systems vary by jurisdiction. CO2 can cause asphyxiation and direct physiological harm. Do not assume it is safe for an occupied space merely because an alarm or delay is present. Gaseous-agent designs need appropriate life safety measures, potentially including pre-discharge warning and evacuation controls. Determine delay, abort, and exposure requirements from the listed system and applicable standard; do not add these indiscriminately to sprinkler operation. Portable extinguishers must be correct for the class and staff must know how to use them.

Exam tip: evaluate pre-action and clean-agent protection against the actual hazard, code, occupancy, and authority approval. A clean-agent system does not automatically replace required sprinklers; shutdown interlocks and evacuation measures need an engineered design.

5. People and operations

  • Visitors: sign in, verify identity, issue visible visitor badges, escort at all times, and log. Contractors and cleaning staff need background checks and scheduled access.
  • Deliveries: receive in a separate area; inspect before entering secure zones.
  • Employees: badges worn visibly, challenge unknown persons, report lost badges, and offboard promptly.
  • Awareness: social engineering (pretexting, tailgating, dumpster diving). Counter dumpster diving with shredding and locked disposal bins.
  • Personnel safety: emergency exits, duress codes, evacuation drills, first aid, and safe travel guidance (see Lesson 18). Life safety always overrides asset protection.
  • Maintenance and audits: test alarms, generators, and fire systems; review logs and access lists; conduct physical penetration tests.

6. The information system lifecycle

Security is cheaper and stronger when built in from the beginning. A generic lifecycle (ISO/IEC/IEEE 15288 and NIST SP 800-160 describe similar stages) has these phases:

Phase Purpose Key security activities
1. Requirements (initiation/planning) Define what the system must do Business need, security and privacy requirements, data classification, regulatory needs, preliminary risk assessment, threat modeling
2. Design/architecture Decide how Secure design principles, control selection, architecture review, threat model refinement, third-party evaluation
3. Development/implementation Build or acquire Secure coding, code review, supply chain controls, configuration baselines
4. Integration, verification and validation Check it meets requirements Security testing, vulnerability assessments, user acceptance, certification
5. Deployment (release/acceptance) Move to production Accreditation/authorization to operate, hardened configuration, change management, training
6. Operations and maintenance Run and keep secure Monitoring, patching, backup, incident response, periodic reassessment, configuration management
7. Retirement (disposal) Remove safely Data migration, secure sanitization or destruction, access revocation, archival, license and documentation closure

Notes:

  • Verification asks "did we build the system right?" (against specifications). Validation asks "did we build the right system?" (meets the user need).
  • In historical certification-and-accreditation terminology, certification is technical evaluation and accreditation is management risk acceptance. Current NIST RMF distinguishes assessment and authorization; other certification schemes use different meanings.
  • Change management (Lesson 17) governs modifications; unreviewed changes erode security.
  • Security requirements should be traceable from requirement to design to test (a requirements traceability matrix), so nothing is forgotten.
  • Lifecycle models vary (waterfall, agile, DevOps), but the security activities remain; they simply repeat in shorter cycles. Software-specific aspects are in Lesson 19.

6.1 Operations and maintenance

Most of a system's life is in operations. Security tasks include patch management, vulnerability scans, log review, backup testing, access reviews, capacity management, and re-evaluation when threats or business needs change. A system that has drifted away from its approved baseline is a risk: use configuration management and drift detection.

6.2 Retirement and disposal

End-of-life is often neglected, and retired systems are a frequent source of data leaks. Steps:

  1. Decide on retirement when support ends, risk exceeds benefit, or the business no longer needs the system.
  2. Retain or archive the data required by law and policy; migrate what is still needed.
  3. Revoke accounts, certificates, keys, firewall rules, and network connections; close active inventory and monitoring entries while retaining a retired asset record and required evidence. Do not destroy keys still needed for lawful retention or migration.
  4. Sanitize or destroy media based on data sensitivity (see below).
  5. Document the disposal with certificates of destruction from vendors.
  6. Close contracts and licenses; update continuity plans.

6.3 Media sanitization

Use NIST SP 800-88 Rev. 2 (September 2025) categories, selecting a method for the target data, recovery threat, media, and reuse or disposal plan:

Method Meaning Use
Clear Logical sanitization of user-addressable storage Use where its assurance meets the assessed recovery threat
Purge Approved techniques making recovery infeasible at the required higher effort, potentially including cryptographic erase Method and implementation must establish the required assurance, not merely carry a "secure erase" name
Destroy Physical methods making the medium unusable and recovery infeasible Use when required by policy or where acceptable sanitization for reuse cannot be established

Notes: degaussing does not work on SSDs or optical media. Solid-state drives wear-level data, so simple overwrites may miss blocks; assess an approved cryptographic erase or device sanitization procedure, and destroy when acceptable purge cannot be established. Cryptographic erase depends on suitable prior encryption and sanitization of all relevant key copies and recovery paths. Data remanence is residual data after deletion. File deletion or quick formatting alone does not establish sanitization. Verify operation completion, validate its effectiveness, and retain the outcome. In the cloud, assess provider sanitization evidence, backup retention, key caches, and recoverable key-deletion states; a delete request is not proof of immediate erasure.

Worked example 2: retiring a legacy database server.

Scenario. A hospital replaces an old patient-scheduling server that held protected health information on SSDs. The facilities team proposes to format the drives and donate the server to a school.

Reasoning, step by step.

  1. The data is highly sensitive, and the equipment will leave organizational control.
  2. Quick formatting alone does not establish sanitization, and SSD wear leveling complicates logical overwriting.
  3. Assume the hospital's approved policy requires purge for these SSDs. Use a validated procedure with suitable encryption coverage and key sanitization, or another approved media-specific purge technique. Destroy drives if the required outcome cannot be established.
  4. Before sanitizing, confirm that required records were migrated and retained per retention rules, and revoke accounts, certificates, and network rules.
  5. Record asset tags, serial numbers, method, date, and operator, and keep the certificate of destruction.

Solution. Apply an approved purge procedure with verification and validation or physically destroy the drives, plus access revocation, records retention, and documentation. Donate the chassis and any reusable drives only after the approved sanitization and validation decisions.

Why other choices are weaker. Formatting and a single overwrite pass on an SSD may leave recoverable data. Degaussing does nothing on flash. Donating unsanitized drives creates disclosure risk; notification duties depend on the facts and applicable law.

7. Mini case study

Scenario. Northlake Credit Union is opening a small regional data center in a converted warehouse. Findings from the pre-opening review: (a) the room is next to the loading dock; (b) the plan uses wet-pipe sprinklers throughout; (c) one badge reader controls the door, and employees often hold it open for colleagues; (d) backup tapes are kept in a cabinet in the same room; (e) the old core banking servers will be retired next month, and the plan is to ship them to a recycler "as is" to save time.

Task. Recommend corrective actions with reasons.

Commented solution.

  1. Location (a): the loading dock brings strangers, vehicles, and delivery traffic. Move the data center to the building interior or, if impossible, add solid walls, no direct door to the dock, and a separate staging area for deliveries.
  2. Fire suppression (b): have a qualified fire-protection designer assess water-damage risk and applicable code. Consider a suitable pre-action design and/or supplemental clean-agent system while retaining required automatic protection and engineered life-safety controls.
  3. Access control (c): install a mantrap or turnstile, require badge plus PIN, enable anti-passback, log and review access, and train employees to challenge tailgating.
  4. Backups (d): move copies to a secure offsite location with encrypted media, a check-in log, and tested restores; a fire in the room would otherwise destroy both production and backups.
  5. Retirement (e): before shipping, migrate and archive required records, revoke credentials and connections, purge or destroy the drives per NIST SP 800-88, and obtain certificates of destruction. Shipping unsanitized drives to a third party is a data breach risk.
  6. Governance: add environmental monitoring, scheduled testing of alarms, UPS, and generator, and a periodic physical penetration test.

Prioritization. Address immediate life-safety or code deficiencies first. Then use the risk assessment to sequence access, retirement, location, and backup improvements; the findings alone do not prove which event has the highest likelihood.

8. Common pitfalls and exam tips

  • Pitfall: relying on one control (a fence or a camera). Physical security must deter, detect, delay, and respond.
  • Exam tip: life safety first: provide free emergency egress even if entry remains locked; suppression design must account for exposure limits, evacuation, and the applicable system standard.
  • Exam tip: compare listed suppression options under the applicable code and hazard assessment. Portable-extinguisher guidance is not a rule to remove required automatic sprinklers.
  • Pitfall: confusing tailgating (unknowing) and piggybacking (knowing). The mantrap addresses both.
  • Exam tip: CPTED questions: natural surveillance, access control, territorial reinforcement, maintenance.
  • Pitfall: treating deletion or formatting as sanitization.
  • Exam tip: sanitization assurance depends on data, recovery threat, policy, and media; degaussing works only on magnetic media.
  • Exam tip: certification is technical evaluation; accreditation is management's risk acceptance; retirement is part of the lifecycle and has security tasks.
  • Pitfall: keeping backups in the same room as production systems.

Key terms

  • CPTED: designing the environment to reduce crime.
  • Mantrap: interlocked access-control vestibule; anti-tailgating effectiveness depends on occupancy and authentication controls.
  • Tailgating / piggybacking: following an authorized person without or with their knowledge.
  • Pre-action sprinkler: detection-controlled water admission, with single-, double-, or non-interlock variants.
  • Clean agent: gas fire suppressant that leaves no residue.
  • UPS / generator: short-term battery power / long-term power.
  • Chain of custody: documented control of evidence from collection to court.
  • Verification / validation: built right (to specification) / built the right thing (user need).
  • Clear / purge / destroy: NIST SP 800-88 sanitization levels.
  • Data remanence: residual data after deletion.

Summary checklist

  • I can apply CPTED and layered physical defense to a site.
  • I can select controls for wiring closets, server rooms, media storage, and evidence storage.
  • I can choose the correct power, HVAC, water, and fire controls and explain pre-action and gas suppression.
  • I can distinguish tailgating from piggybacking and select appropriate access controls.
  • I can list the lifecycle phases and the security activities of each.
  • I can explain verification versus validation and certification versus accreditation.
  • I can choose between clear, purge, and destroy for a given media and risk.

Coordinate retirement with data retention and media sanitization. Link physical controls to secure design principles, and preserve investigation records using evidence handling and chain of custody.

Official sources