What is Physical Security?

While much of modern compliance focuses on digital controls, physical security remains essential because physical access to systems can bypass logical controls entirely. A comprehensive physical security program addresses facility access (badge readers, biometric systems, mantraps for sensitive areas), visitor management (sign-in procedures, escort requirements, visitor logs), environmental controls (fire suppression, HVAC for server rooms, flood detection, uninterruptible power supplies), equipment security (cable locks, secure disposal of hardware, asset tracking), and surveillance (CCTV monitoring, recording retention). For organizations using cloud infrastructure, physical security responsibility shifts largely to the cloud provider — AWS, Azure, and GCP all maintain SOC 2 reports covering their data center physical security. However, organizations remain responsible for their office environments. SOC 2 auditors verify physical access controls through observation and review of access logs. ISO 27001 includes detailed physical security controls in its Annex A. HIPAA requires physical safeguards including facility access controls and workstation security.