Someone holds the door for a person carrying boxes. The server closet stays unlocked because the key went missing last spring. A carton of old laptops sits by the back door waiting for the recycler. None of this involves malware, and any of it can end in a breach report.
The free guidance
Where to begin. CISA's physical security pages cover access control, surveillance and protecting people and buildings. Its Cyber-Physical Convergence Scenarios show how a physical gap turns into a digital one.
Insider risk. The CISA Insider Threat Mitigation Guide explains how to spot and respond to risk from people who already have access, whether they mean harm or are simply careless.
Practice. CISA Tabletop Exercise Packages are free, ready-made scenarios, some of them physical. An hour around a table with one of them often surfaces gaps a policy review misses.
Old drives and laptops. NIST SP 800-88 Rev. 2 is NIST's guidance on media sanitization: how to clear, purge or destroy storage before it leaves your hands.
Keeping the business running. Ready.gov's business pages help you plan for fire, flood and power loss, which are physical events too.
A second view. The UK National Protective Security Authority publishes practical guidance on building security and insider risk.
A walk-through checklist
Walk the office once with a notebook and check:
- who holds keys or badges, and whether leavers' access was removed
- whether visitors sign in and are escorted
- whether network gear sits in a locked room or cabinet
- whether desks are clear of papers with customer data at the end of the day
- whether screens lock when people step away
- whether there is a written process for disposing of old devices
What counts as evidence
ISO 27001 keeps its physical controls in Annex A.7, starting with A.7.1 on physical security perimeters. For healthcare, HIPAA's physical safeguards are in §164.310. In both cases an auditor accepts plain evidence: a dated photo of the locked server room, the visitor log, and a certificate from your recycler naming the devices it destroyed and when.
Keeping the record
Keel's free Acceptable Use and Incident Response policy templates cover what staff may do with company equipment and how a security incident is reported and handled. The Acceptable Use & Insider Risk training course is included on the Free plan, so every person who holds a key can take it. Inside Keel, you upload the photos and certificates to your evidence library and link them to the control they prove.
Browse the free templates, or start free.
That closes Cybersecurity Awareness Month. Every resource from the series is collected in our free resource guide.