CyberSolace / Physical Security
Protect the places
your business
depends on.
Independent assessment and controlled testing of the physical controls that protect your people, equipment and information.
A practical view of your premises, connected to your wider cyber security programme.
01 Site
02 Access
03 Sensitive areas
One connected view
Security extends
beyond the screen.
Your premises are part of your information security. The way people enter, move around and handle equipment matters.
Physical access can expose sensitive information or create a route to systems and assets. The question is whether your controls work together in practice, and whether they are proportionate to what you need to protect.
We help leadership teams understand that picture, identify gaps and decide what to address first.
Two ways to gain assurance
Review the controls.
Test their effectiveness.
01
Physical security assessment.
An independent review of your premises, facilities and working practices. We examine the controls in place, how they are managed and where weaknesses could affect your people, assets or information.
- Perimeter and access management
- Restricted areas and server rooms
- Visitor and contractor arrangements
- Desk practices and asset handling
02
Physical penetration testing.
A controlled exercise to test agreed aspects of your defences under realistic conditions. It can reveal gaps between a documented process and what happens in practice. The value is not simply whether someone gains entry: it is also whether unusual activity is noticed, challenged and escalated.
- Agreed attempts to access restricted areas
- Tailgating and social engineering exercises
- Responses to suspicious activity
- Routes towards critical systems or data
The scope we agree with you
From the entrance
to the sensitive area.
We focus the engagement on the places, assets and processes that matter to your organisation. The scope can cover:
Premises and perimeter.
How access to the site or building is controlled, and how those arrangements are managed.
People coming and going.
Visitor, contractor and staff access, including how people verify identity and respond to an unexpected request at an entry point.
Restricted spaces.
Protection of server rooms, secure areas and other locations where access needs closer control.
Information and equipment.
How documents, workstations and physical assets are handled, stored and disposed of in the working environment.
A considered engagement
Clear boundaries.
Useful findings.
We agree the purpose and scope before work begins. Written authorisation and rules of engagement set out permitted activities, excluded areas and when to pause or stop. Testing is planned around the safety of people and the continuity of your operations.
01 / Define
Agree what matters.
Understand the premises, priorities and concerns. Agree boundaries, client contacts and how any sensitive evidence will be handled.
02 / Examine
Gather the evidence.
Review controls and working practices, or carry out the agreed testing. Record observations, responses and limitations without going beyond the authorised scope.
03 / Prioritise
Make the next steps clear.
Explain the findings, their business relevance and practical recommendations so you can decide what to address first.
What you receive
Evidence you
can act on.
A clear, prioritised report for both technical and non-technical readers, with recommendations that fit your environment.
- Findings in context. The weaknesses identified and why they matter to your people, assets and information.
- A record of the testing. For penetration tests: what was attempted, what succeeded, what was prevented and how the observed gaps contributed to the outcome.
- Practical priorities. Recommendations to help you target the gaps that need attention.
- Support for wider assurance. Relevant findings can inform your security programme and evidence for applicable ISO 27001 controls.
Before we begin
A few practical questions.
Do we need an assessment or a penetration test?
An assessment reviews the controls and processes you have in place. A penetration test checks agreed elements through controlled attempts to challenge those defences. We can help you choose the approach that fits your concerns and current position.
How do you control a physical penetration test?
We agree written authorisation and rules of engagement with your team before testing. These define the permitted activities, excluded areas, client contacts and pause or stop conditions. We also agree how evidence will be recorded and handled, particularly where sensitive information could be encountered.
Can this support our ISO 27001 programme?
Yes. We can consider relevant physical security controls and structure findings to support your evidence and improvement planning. The engagement is not a certification audit and does not guarantee certification.
Can this sit alongside a cyber assessment?
Yes. Physical security work can be delivered independently or as part of a broader cyber assessment or governance engagement, giving you a connected view of the risks.
Let’s take a closer look
What needs protecting
in your environment?
Whether you have a specific concern or want a broader view of your premises, we are happy to have an initial conversation at no obligation.