4.2 Collaborate with Physical Security Operations

Collaborate with Physical Security Operations

SSCP Knowledge Area 1.8 asks you to collaborate with physical security operations. The October 1, 2025 outline examples are data-center and facility assessment, badging and visitor management, and personal-device restrictions. The SSCP is rarely the person who hires lobby officers or buys cameras. You are the practitioner who makes sure physical controls and logical controls tell the same story: a badge that still works after human resources terminated the user is an identity failure; a closed-circuit television (CCTV) archive that incident response cannot obtain is a collaboration failure.

Physical controls from Knowledge Area 1.3 — mantraps, cameras, locks — show up here as operations. You assess the facility with the physical-security team, you keep badges tied to the joiner-mover-leaver process, and you keep personal devices, especially Universal Serial Bus (USB) media, out of places where they can copy production data.

Why the Verb Is Collaborate

Information security owns policy, identity, logging, and the data. Physical security owns officers, cameras, badges, doors, and the building. Neither team can close a tailgating-plus-malware incident alone.

Operational hand-offs SSCPs actually run:

• Badge issuance and revocation tied to identity and access management (IAM) and human resources, not a separate spreadsheet in the guard booth
• After-hours badge-in correlated with virtual private network (VPN) and workstation logons (impossible travel or badge sharing)
• Camera review during incident response, with a request path that does not take three days
• Joint assessments of the data hall, loading dock, and meet-me room
• Shared training: officers learn social engineering at the door; information-technology staff learn not to hold the data-hall door for a friendly face

Scenario. Human resources terminates a contractor at 16:00. IAM disables the directory account at 16:07. The proximity badge still opens the data-center mantrap at 16:40 because physical security's badge system is not in the leaver workflow. That is a Domain 1 failure even though the directory account is already dead.

Data Center and Facility Assessment

Walk the site with facilities and physical security. The exam expects you to know what good looks like for a room that holds production systems, not to recite construction trivia.

A mantrap (sometimes called an airlock) is two interlocking doors: the inner door will not open until the outer door is closed and an occupancy sensor agrees that one authorized person is inside. A turnstile — optical or full-height — is a throughput control in a lobby. It is not equivalent to a mantrap in a high-security data hall. Anti-passback refuses a badge that was used to enter until it has been used to exit, which makes shared or cloned badges noisy.

Two-person integrity (dual control) appears in some high-security halls and in key-ceremony rooms: two authorized people must be present to open a cage or a hardware-security-module enclosure. That is a physical expression of segregation of duties.

Scenario. During a facility assessment you find the data-hall mantrap's occupancy sensor bypassed because people were getting stuck with rolling carts. Staff now badge and hold the inner door for whoever is behind them. The preventative control is documented; the operation is tailgating by design. Restore the sensor, add a materials-handling procedure such as a lockable cart vestibule, and do not accept a permanent bypass.

Include loading docks and dumpsters in the walk. A box of decommissioned disks on a loading dock is an asset-disposal failure from Knowledge Area 1.5 and a physical-security finding. A meet-me room where any telecom technician can sit with a laptop on a production demarcation is a network-security problem you will meet again in Domain 6, but you catch it first on a facility assessment.

Badging, Turnstiles, and Tailgating

A badge — proximity card, smart card, or mobile credential — is a physical authenticator. Treat it like a password you can photograph: issuance, custody, loss reporting, and revocation must match IAM.

• Employee badges: issued at onboarding after identity proofing, collected or remotely disabled at exit, visually distinct from visitor and contractor badges
• Contractor badges: time-bounded, tied to a named sponsor, set to auto-expire
• Lost or stolen: report immediately, disable in the physical-access system, investigate whether the credential was used after the report
• Cloning and found badges: train people not to loan badges; anti-passback and camera review make a cloned or shared badge an event of interest

Tailgating is following an authorized person through a controlled door without authenticating. Piggybacking is often reserved for the case where the authorized person holds the door for the follower. Exam items may use the terms loosely. The operational point is the same: the door opened for one authentication event and two bodies passed. Mitigations are mantraps, full-height turnstiles, officers, cameras, and a culture that does not treat being polite as a control exception.

Scenario. A SOC analyst badges into the office turnstile. Someone in a delivery uniform calls hold that, I am with facilities. The analyst holds the gate. That is piggybacking. Training from Knowledge Area 1.7 plus a turnstile that alarms on two bodies is defense in depth. Neither works if information security and physical security never agreed who responds to the alarm.

Visitor Management and Escorts

Visitors are expected. Unmanaged visitors are an incident waiting for a clipboard. The flow below is the operational sequence the SSCP should be able to walk with physical security — including the data-hall branch, where escort and device rules tighten.

A workable visitor process matches that flow:

1. The host pre-registers the visitor: name, organization, purpose, date, and areas.
2. The lobby confirms government identification against the registration, issues a visitor badge that is visually obvious (color, large VISITOR marking, printed date), and records a log with in and out times.
3. The host or a trained escort collects the visitor. Unescorted access to data halls, wiring closets, and console rows is prohibited.
4. Photography, personal USB, and personal laptops are restricted per the area.
5. The badge is collected at exit and the log is closed. Overnight visitor badges do not exist.

Vendors who need recurring data-hall access are contractors, not visitors who come a lot. They get contractor credentials with expiry, whatever background process your physical-security policy requires, and the same escort rules the policy states for the hall.

After-hours visitors are a special case: the lobby may be closed, so the process must name who can admit a vendor at 02:00 (usually an on-call sysadmin plus physical security), and the badge system must still log it. A night engineer who props a door for a disk-shelf replacement without a visitor record has created an unaccountable person in the hall.

Scenario. A storage vendor arrives to reseat a disk with no ticket and no pre-registration. The lobby officer is busy and waves them through with a paper sticker. The SSCP collaborating on visitor management writes the rule: no data-hall access without a change record, a named escort, and a time-limited badge — even for the usual vendor. Social engineering of the lobby is how physical intrusion starts.

Personal Device Restrictions and Clean Desk

Data halls and high-sensitivity rooms are not coffee-shop coworking space.

Clean desk is an administrative control with a physical outcome. It belongs in awareness (Knowledge Area 1.7) and in physical operations (Knowledge Area 1.8) because officers and cameras can spot a badge hanging on a monitor bezel and a stack of printed payroll files on a vacant desk. The SSCP helps write the standard, then asks physical security to include it on walkthroughs.

Scenario. A network engineer wants to copy a packet capture off a production switch with a personal USB stick because the jump host does not have enough disk. That request is a personal-device restriction issue, not a storage inconvenience. The approved path is copy to the managed jump host and transfer via the approved file channel. Never introduce unmanaged media into the hall.

CCTV, Logging, and Joint Incident Work

CCTV is a detective physical control, and a visible camera is also a deterrent. Collaboration means:

• Coverage of doors, mantraps, and aisles — not decorative cameras that point at a plant
• Retention aligned with investigation needs and privacy law (do not invent a retention number the organization has not set)
• A request path so the SOC and forensics can pull video for a badge event or a tailgate without a week of email
• Time synchronization among cameras, the badge system, the directory, and security information and event management (SIEM). Unsynchronized clocks destroy investigations.

Correlate physical and logical events. Badge-in at the data hall while the same user's VPN is active from another country is a shared-credential or stolen-badge event. A visitor badge still showing in at 23:00 with no escort checkout is a physical-security incident the SOC should hear about if that visitor was near production. Door-forced and door-held-open alarms should page physical security and land in the SIEM as events of interest.

Quarterly access recertification should include physical entitlements — who can open the hall — alongside logical group membership. Tabletop exercises from Knowledge Area 1.7 should include the lobby supervisor when the scenario is a vendor at the door or a tailgate. Facility assessments should have an SSCP on the walk, not only facilities staff.

When you sit the exam, the verb is collaborate. Answers that say the sysadmin rekeys the building, or that physical security is out of scope for SSCP, are both wrong. You assess, you bind badges to identity, you restrict devices in the hall, and you share events with the people who own the doors.