2.2 Inside-Out, Outside-In, Site-Specific & Functional Models
Key Takeaways
- Inside-outward starts at the highest-consequence asset and expands through adjacent spaces to the site boundary.
- Outside-inward starts at the perimeter and can miss insider theft that never crosses a fence.
- A site-specific model is built for this parcel, occupancy, and operating pattern; copying another campus's survey is not site-specific work.
- A functional model follows a business process such as receive-putaway-pick-ship rather than a floor plan alone.
- Each model fails when its starting assumption does not match the adversary or the mission.
Choosing a Model Before You Choose a Checklist
A physical security assessment is not a random door audit. The assessor needs a model: a rule for where to start, what to expand into next, and what counts as in-scope risk. Independent OpenExamPrep teaching for published PSP Domain 1 tasks covers four models you will actually use on a hospital, data center, warehouse, or corporate campus: inside-outward, outside-inward, site-specific, and functional. None of them is universally best. Each one fails in a predictable way when the starting assumption does not match the adversary or the mission.
The assessment plan from the previous section should name the model. If the plan is silent, the walkthrough will silently pick whatever is nearest the parking space.
Inside-outward: protect the critical asset, then expand
Inside-outward starts at the asset of highest consequence and works outward through the room, the suite, the building, the yard, and only then the perimeter. The question is not how pretty the fence is. The question is what must not be lost, delayed, contaminated, or disclosed, and which paths reach that asset.
Worked hospital example: the critical assets named in the plan are the pharmacy vault, the infant unit, and the emergency generator. Inside-outward begins in the pharmacy: vault construction, anteroom control, dual custody, camera views of the fill line, after-hours badge exceptions, and the waste path for returned medication. Next comes the corridor that feeds the pharmacy, the staff stair that bypasses the public lobby, the loading dock where wholesaler totes arrive, and only later the campus fence. If you had started at the decorative front canopy, you might never have reached the vault on a one-day visit.
Worked data-center example: start in the highest-density hall or the customer cage that holds the tenant of greatest consequence. Document who can open the cage, how the raised-floor plenum is entered, whether the roof hatch drops into that hall, and how the generator and fuel plant can darken that hall. Expand to the mantrap, the loading dock, then the vehicle approaches. Perimeter crash ratings matter, but they are not the first sentence if the threat of record is a contractor with a badge and a USB stick.
When inside-outward fails: it can under-examine wide-area threats that never aim at your chosen jewel. A campus that starts only in the executive suite may miss a vehicle-borne hazard at the shared daycare drop-off, or a warehouse fire-load problem in the idle trailer yard that can take the whole site down. It also fails when the critical-asset list from planning is wrong. If operations never told you the real jewel is the backup tape store, you will polish the wrong room.
Outside-inward: perimeter first
Outside-inward starts at the property line and works in: approaches, fencing, lighting, landscaping, vehicle barriers, building skin, then interior layers. This model fits sites whose dominant story is intrusion from the outside: a distribution warehouse in an industrial park, a data center with a documented vehicle threat, or a campus that has already suffered fence-line copper theft.
Worked warehouse example: begin on the public road. Note overwatch, truck queuing, and whether a tractor can reach the yard without a gate transaction. Walk the fence for climb points, washouts, and dark stretches. Then the gatehouse, the trailer lot, the dock seals, then the high-value cage. Lighting measurements belong early because they are a perimeter control, not a lobby decoration.
Worked campus example: start at each vehicle mouth, including the after-hours service drive the day receptionist never sees. Then the loading dock shared by food service and the research building, then the building envelope, then the lab.
When outside-inward fails: it over-weights fence-line adversaries and can under-examine insider paths to information assets. Classic miss: an R&D campus with excellent fencing, vehicle barriers, and a manned gate that still loses prototype drawings because a trusted engineer emails files or walks out with a prototype in a backpack. The perimeter never had a chance to stop that loss. Outside-inward also fails on a hospital if you spend the morning on decorative bollards and never reach medication diversion or infant abduction, which are not fence problems.
Site-specific risk assessment: this parcel, this occupancy, this hour
A site-specific model refuses to copy last year's survey from another building. It asks what is unique here: occupancy (inpatient hospital versus office), hours, neighborhood crime that actually reaches this block, shared walls with tenants, weather that kills cameras, union rules, clinical constraints, and the real adversary history. Two warehouses owned by the same company are not the same site if one ships consumer electronics next to a public trail and the other ships bulk paper behind a rail spur.
Worked data-center example: a suburban colocation hall with a single manned gate is not assessed with a copied checklist from an urban high-rise meet-me building. Snow load on roof hatches, rural police response time, fuel-delivery frequency, and customer cage rules are local facts. Site-specific work uses those facts to choose which other model to emphasize, not to invent a new physics of locks.
When site-specific work fails: teams use the phrase while still pasting another campus's camera count. Site-specific also fails when local color becomes an excuse to skip a needed layer: this neighborhood is safe is not a model. Another failure mode is treating a hospital tower and its detached medical office building as one site because they share a logo, even though they have different owners, occupancies, and after-hours populations.
Functional approach: follow the business process
A functional model organizes the assessment by how the organization makes money or delivers care, not by floor number. You walk the process: people, information, goods, and waste as they move.
Worked warehouse (third-party logistics) example: map receive, quality hold, putaway, pick, pack, ship, and returns. At receiving, who can divert a tote before it hits inventory? During putaway, can a picker reach the high-value cage without a second person? At ship, who controls trailer seals, and does the driver lounge have a view of the yard? Shrink often lives in the process, not in the decorative fence.
Worked hospital example: follow the medication path from wholesaler dock to pharmacy to floor to waste. Follow the infant path from labor and delivery to discharge. Follow the behavioral-health patient path through the emergency department. Those processes cross many departments; a floor-by-floor walk will chop them into meaningless door notes.
Worked campus example: follow prototype hardware from the lab bench to the shipping dock used for customer evaluations. Follow executive travel from the parking garage to the boardroom. Follow after-hours cleaning through the data closet.
When the functional model fails: the process map is incomplete. If you map pick-pack-ship and omit returns and trash, you miss the back door used to walk product out. Functional work also fails when there is no stable process: a construction-phase hospital wing does not yet have a medication path, and a site-specific plus outside-inward blend may be more honest until occupancy.
Combining models without pretending you used all of them
Real engagements often lead with one model and sample another. A data center with a vehicle-threat concern may lead outside-inward, then switch inside-outward at the generator plant. A warehouse with documented shrink may lead functional, then still walk the fence because copper theft is a second problem. State the lead model in the plan so reviewers can see what you chose not to emphasize.
The comparison flow below is a planning aid, not a scoring algorithm. If one asset of extreme consequence dominates (pharmacy vault, infant unit, a single tenant cage), start inside-outward. If the dominant threat is external intrusion, start outside-inward. If loss follows a process, go functional. If none of those sentences is true, build a site-specific picture first, then pick a lead lens. Whatever you pick, write down how it can fail on this site so the survey report does not hide the blind side.
Which assessment model starts at the asset of highest consequence and expands through adjacent spaces toward the site boundary?
An outside-inward survey of an R&D campus documents excellent fencing and vehicle barriers but misses theft of prototype drawings by a trusted engineer. Why did the model fail for that loss?
A third-party logistics warehouse wants the assessment organized around order fulfillment: receiving, putaway, pick, pack, and ship. Which model matches that request?