Preparing your learning space...
91% through Projects tutorials
In this project, you will design a secure office from the ground up. You'll consider physical security, network architecture, access control, surveillance, environmental controls, and security policies. The goal is to create a comprehensive office design that protects people, data, and assets.
DataGuard Consulting is a cybersecurity consultancy moving into a new 5,000 sq ft office space. They need the office designed with security in mind from day one. The office will house 40 employees plus a small data center / lab area.
Office Layout:
💡 Free Lab Setup: Office design is a planning-only project — no special software needed!
- draw.io — Floor plans and network diagrams (free)
- Google Sheets — Budgets and checklists (free)
- Google Docs / LibreOffice — Policy documents (free)
- Canva — Security signage design (free tier)
- All templates and checklists are included — just fill them in.
- Budget/equipment sections are for real-world reference only.
📋 Your Step-by-Step Task:
- Read the DataGuard Consulting office scenario (below)
- Perform a physical security assessment using the site survey checklist
- Design the office floor plan with security zones using draw.io (free)
- Design the access control system — reader placement, badge levels
- Plan CCTV camera placement with coverage map
- Design the server room and wiring closets (physical + environmental)
- Create a visitor management process flow
- Write 3 security policies (use the templates provided)
- Build a budget using the cost breakdown table
- Complete the deliverables checklist and take the quiz
After completing this project, you will be able to:
DEFENSE IN DEPTH:
Multiple layers of security so if one fails, another protects.
┌────────────────────────────────────────────────────┐
│ OUTER PERIMETER │
│ (Property line, parking, building exterior) │
│ ↓ │
│ BUILDING ENTRY │
│ (Lobby, reception, main entrance) │
│ ↓ │
│ OFFICE PERIMETER │
│ (Office entrance, reception area) │
│ ↓ │
│ INTERNAL ZONES │
│ (Department areas, conference rooms) │
│ ↓ │
│ HIGH-SECURITY ZONES │
│ (Server room, lab, management offices) │
│ ↓ │
│ ASSET LEVEL │
│ (Encrypted data, locked cabinets, secure storage) │
└────────────────────────────────────────────────────┘
| Principle | Application to Office Design |
|---|---|
| Least Privilege | Employees access only areas needed for their role |
| Segregation of Duties | No single person controls all security aspects |
| Defense in Depth | Multiple layers: badge + PIN + biometric for server room |
| Fail Secure | Locked doors stay locked on power failure |
| Complete Mediation | Every access attempt is checked and logged |
| Privacy by Design | Screen positioning, acoustic privacy, data handling |
| Secure by Default | Default-deny access to all areas; grant explicitly |
BUILDING EXTERIOR:
[ ] Building structure (concrete, brick, glass)
[ ] Number of entrances/exits
[ ] Windows (ground floor accessibility)
[ ] Parking lot security (lighting, barriers)
[ ] Adjacent businesses (shared walls?)
[ ] Rooftop access
[ ] Loading dock / service entrance
[ ] Trash disposal area (document shredding?)
BUILDING INTERIOR:
[ ] Floor plan and square footage
[ ] Ceiling type (dropped? access panels?)
[ ] Raised flooring
[ ] HVAC system and ductwork
[ ] Electrical room location
[ ] Telecom room / IDF locations
[ ] Elevator access
[ ] Stairwell access
[ ] Fire suppression system
[ ] Emergency exits
SURROUNDING ENVIRONMENT:
[ ] Crime statistics for area
[ ] Nearby high-risk tenants
[ ] Police/fire response time
[ ] Environmental risks (flood zone, etc.)
| Risk Factor | Your Office | Mitigation |
|---|---|---|
| Ground floor access | 2nd floor office | No ground floor risk |
| Shared building | Yes | Separate access control |
| Nearby public transit | Yes (streetcar) | Increased foot traffic |
| Window access | 3 windows (sealed) | Window alarms |
| After-hours access | Janitorial staff | Escort policy |
DESIGN SPECIFICATIONS:
┌────────────────────┬─────────────────────────────────┐
│ Feature │ Recommendation │
├────────────────────┼─────────────────────────────────┤
│ Main entrance │ Single controlled entrance │
│ Glass doors │ Laminated security glass │
│ Door construction │ Metal frame, solid core │
│ Locks │ Electronic card reader + key │
│ Reception window │ Bullet-resistant glass (optional)│
│ Lighting │ Well-lit entrance (100+ lux) │
│ Camera coverage │ 100% entrance coverage │
│ Intercom │ Video intercom for after-hours │
│ Deterrent signage │ "24-Hour Video Surveillance" │
└────────────────────┴─────────────────────────────────┘
DOOR HARDWARE:
- Magnetic locks with manual release
- Door position sensors (monitor open/closed)
- Delayed egress (alarm if held open >15 seconds)
- Request-to-exit (REX) sensors
- Manual override (fire alarm release)
RECEPTION / LOBBY DESIGN:
┌──────┬─────────────────────────────────────────────┐
│ Zone │ Details │
├──────┼─────────────────────────────────────────────┤
│ Area │ 200 sq ft lobby with welcome desk │
│ Desk │ High counter (prevents jumping) │
│ View │ Clear view of entrance and waiting area │
│ Access│ Sliding glass door staff-controlled │
│ Visitor│ Register at reception, receive badge │
│ Package│ Designated package receipt area (screened) │
│ Restroom│ Visitor restroom (no internal access) │
└──────┴─────────────────────────────────────────────┘
ACCESS CONTROL SYSTEM SPECIFICATIONS:
┌────────────────────┬─────────────────────────────────┐
│ Component │ Specification │
├────────────────────┼─────────────────────────────────┤
│ Controller │ 4-door IP controllers │
│ Reader type │ Card + PIN (multi-factor) │
│ Card technology │ Smart card (DESFire, iCLASS) │
│ Biometric readers │ Fingerprint (server room only) │
│ Management station │ Centralized access control SW │
│ Power supply │ Battery-backed (8 hours) │
│ Network │ Isolated control network │
│ Wiring │ Shielded, tamper-detection │
└────────────────────┴─────────────────────────────────┘
DOOR ACCESS LEVELS:
Level 0 — Public: Lobby, reception (no badge needed)
Level 1 — Employee: Open office, break room
Level 2 — IT Staff: Server room, wiring closets
Level 3 — Management: Server room, private offices
Level 4 — Executive: Server room, CEO/CFO offices
Level 9 — Emergency: All doors (fire alarm override)
| Area | All Employees | IT Staff | Management | Executives | Visitors |
|---|---|---|---|---|---|
| Reception / Lobby | ✅ | ✅ | ✅ | ✅ | ✅ |
| Open Office | ✅ | ✅ | ✅ | ✅ | Escorted |
| Conference Rooms | ✅ | ✅ | ✅ | ✅ | ✅ |
| Break Room | ✅ | ✅ | ✅ | ✅ | Escorted |
| Private Offices | ❌ | ✅ (on request) | Own only | Own only | ❌ |
| IT Wiring Closet | ❌ | ✅ | ❌ | ❌ | ❌ |
| Server Room | ❌ | ✅ + Biometric | ✅ + Biometric | ✅ + Biometric | ❌ |
| Lab / Test Area | ❌ | ✅ | ❌ | ❌ | ❌ |
| Storage Room | ❌ | ✅ | ✅ | ✅ | ❌ |
EMPLOYEE BADGES:
┌──────────┬────────────┬───────────────┬────────────┐
│ Badge Type│ Color │ Access Level │ Expiry │
├──────────┼────────────┼───────────────┼────────────┤
│ Employee │ Blue │ Level 1-3 │ Employment │
│ IT Staff │ Blue+Red │ Level 1-4 │ Employment │
│ Executive│ Gold │ Level 1-5 │ Employment │
│ Intern │ Green │ Level 1 │ Rotation │
│ Visitor │ White │ Level 0 │ 1 day │
│ Temp │ Yellow │ Level 0-1 │ Assignment │
│ Contractor│ Orange │ Level 1 │ Contract │
└──────────┴────────────┴───────────────┴────────────┘
BADGE POLICY:
- Badges worn visibly at all times
- Lost/stolen badges reported immediately (deactivated within 1 hour)
- Badge return required on termination (within 24 hours)
- Visitor badges collected at end of visit
- Monthly audit of active badges vs employees
CAMERA PLACEMENT:
┌────────────────────┬─────────┬───────────┬────────────┐
│ Location │ Camera │ Resolution│ Coverage │
├────────────────────┼─────────┼───────────┼────────────┤
│ Main entrance │ Bullet │ 4K │ Full view │
│ Reception desk │ Dome │ 4K │ Person view │
│ Office entrance │ Dome │ 4K │ Door area │
│ Open office │ Dome │ 1080p │ Wide angle │
│ Server room door │ Dome │ 4K │ Door + area │
│ Server room interior│ 360° │ 4K │ Full room │
│ Wiring closet │ Dome │ 1080p │ Door area │
│ Break room │ Dome │ 1080p │ Wide angle │
│ Parking lot │ Bullet │ 4K │ Full lot │
│ Hallways │ Dome │ 1080p │ Directional │
└────────────────────┴─────────┴───────────┴────────────┘
SYSTEM SPECIFICATIONS:
- NVR with minimum 30-day retention
- 4K recording at 15+ FPS (critical areas)
- Night vision / IR for low-light areas
- Motion-triggered recording (save space)
- Offsite backup of footage (cloud or remote NVR)
- Secure access to footage (2-person rule for viewing)
- Privacy masking for bathrooms (by law)
- UPS backup for cameras and NVR
VIDEO SURVEILLANCE POLICY:
1. Cameras are in common areas only (no restrooms, break rooms)
2. Footage retained for 30 days (90 for incidents)
3. Access logs maintained for who viewed footage
4. Footage only reviewed for security incidents
5. Privacy notice posted at all building entrances
6. Annual privacy impact assessment conducted
7. Footage stored encrypted at rest
SERVER ROOM: 300 sq ft (dedicated, no windows)
PHYSICAL ACCESS:
┌────────────────────┬─────────────────────────────────┐
│ Walls │ Floor-to-deck (not dropped ceil)│
│ Door │ Steel, 3-point lock │
│ Access control │ Card + PIN + Biometric │
│ Audit log │ Every entry/exit logged │
│ Emergency exit │ Push bar with alarm │
│ Viewing window │ Laminated glass (optional) │
└────────────────────┴─────────────────────────────────┘
ENVIRONMENTAL:
┌────────────────────┬─────────────────────────────────┐
│ HVAC │ Dedicated CRAC unit │
│ Temperature │ 68-72°F (20-22°C) │
│ Humidity │ 40-60% RH │
│ Fire suppression │ FM-200 / clean agent │
│ Power │ Dual UPS (N+1 redundancy) │
│ Generator │ Natural gas backup │
│ Monitoring │ Temp, humidity, power, water │
└────────────────────┴─────────────────────────────────┘
RACK LAYOUT:
┌────┬──────────────┬─────────────┬────────────────────┐
│Rack│ Equipment │ Power | Cooling │
├────┼──────────────┼─────────────┼────────────────────┤
│ 01 │ Network core │ UPS A │ Front-to-back │
│ 02 │ Servers │ UPS A + B │ Front-to-back │
│ 03 │ Storage │ UPS B │ Front-to-back │
│ 04 │ Lab equipment│ UPS A │ Front-to-back │
└────┴──────────────┴─────────────┴────────────────────┘
WIRING CLOSETS (2 locations):
┌────────────────────┬─────────────────────────────────┐
│ Size │ 4x4 ft (minimum) │
│ Ventilation │ Passive vents + fan │
│ Door │ Solid core, key lock + card │
│ Wall mounting │ Backboard (3/4" plywood) │
│ Patch panels │ CAT6A, labeled both ends │
│ Cable management │ Horizontal + vertical managers │
│ Power │ Dedicated circuit + UPS outlet │
│ Grounding │ Proper telecom grounding │
└────────────────────┴─────────────────────────────────┘
CABLE PATH:
┌──────────────────────────────────────────────────────┐
│ IDF Closet │
│ ┌────┐ ┌──────────────┐ ┌──────────────┐ │
│ │PATCH├───│ Cable Tray ├───│ MDF (Main) │ │
│ │PANEL│ │ (Above ceil)│ │ (Server Rm) │ │
│ └────┘ └──────────────┘ └──────────────┘ │
│ │ │
│ v │
│ Workstation outlets (floor boxes / wall jacks) │
└──────────────────────────────────────────────────────┘
OPEN OFFICE LAYOUT:
┌────────┬────────┬────────┬────────┬────────┬───────┐
│ │ │ │ │ │ │
│ Desk │ Desk │ Desk │ Desk │ Desk │ WIN │
│ │ │ │ │ │ DOW │
├────────┴────────┴────────┴────────┴────────┤ │
│ AISLE │ │
│ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │ │
│ │Desk│ │Desk│ │Desk│ │Desk│ │Desk│ │ │
│ └────┘ └────┘ └────┘ └────┘ └────┘ │ │
└────────────────────────────────────────────┴───────┘
Key design features:
- Monitors positioned to prevent shoulder surfing
- Privacy screens for sensitive work areas
- Cable management channels (trip hazard prevention)
- Adjustable standing desks
- Lockable desk drawers for personal items
- Clear sight lines for natural surveillance
PER WORKSTATION:
[ ] Lockable cable management
[ ] Privacy screen filter (for high-sensitivity roles)
[ ] RFID/NFC asset tag
[ ] Kensington lock slot for laptops
[ ] Secure cable for docking station
[ ] Biometric OR PIN login (no password-only)
[ ] Screen auto-lock (2 minutes inactivity)
[ ] Disk encryption enabled
[ ] Webcam cover
[ ] Headset for private calls (no speakerphone)
SEATING ZONES:
Zone 1 — Low sensitivity: Guest areas, reception
Zone 2 — Standard: Open office for consultants
Zone 3 — High sensitivity: Private offices (management, HR)
Zone 4 — Restricted: Finance, legal, security team
CONFERENCE ROOM DESIGN:
┌────────────────────┬─────────────────────────────────┐
│ Feature │ Specification │
├────────────────────┼─────────────────────────────────┤
│ Door │ Solid core, privacy lock │
│ Windows │ Frosted/film for privacy │
│ AV equipment │ Guest network only │
│ Whiteboard │ Erasable surface only │
│ Soundproofing │ Acoustic panels in walls │
│ Display │ Positioned to not face window │
│ Cable ports │ HDMI + USB (data diodes for sensitive)│
│ Scheduling display │ Shows availability only (no details) │
└────────────────────┴─────────────────────────────────┘
INTERNET (Fiber + 4G Failover)
│
[Firewall/NGFW]
│
[Core Switch L3]
/ │ | \
/ │ | \
[Internal LAN] │ [DMZ] [Management]
│ │ │
v v v
[Access Switches] [Web Servers] [Network Mgmt]
│
┌────┴────┐
│ │
[Employee PCs] [Printers/Cameras]
VLAN DESIGN:
┌─────────┬────────────────────┬──────────────────┐
│ VLAN │ Purpose │ Access │
├─────────┼────────────────────┼──────────────────┤
│ 10 │ Employee LAN │ All employees │
│ 20 │ Management │ IT staff only │
│ 30 │ Guest WiFi │ Visitors/guests │
│ 40 │ VoIP │ Phone system │
│ 50 │ CCTV │ Security team │
│ 60 │ Access Control │ Facility team │
│ 70 │ DMZ │ Public services │
│ 80 │ IoT Devices │ Smart building │
│ 99 │ Management (out-of-band)│ IT staff │
└─────────┴────────────────────┴──────────────────┘
WIFI DESIGN:
SSID: DataGuard-Corp VLAN 10 (WPA3-Enterprise, 802.1X)
SSID: DataGuard-Guest VLAN 30 (Captive portal, rate limited)
SSID: DataGuard-IoT VLAN 80 (PSK, isolated)
SSID: DataGuard-MGMT VLAN 99 (Hidden, management access only)
NETWORK HARDENING:
┌────────────────────┬─────────────────────────────────┐
│ Measure │ Implementation │
├────────────────────┼─────────────────────────────────┤
│ Switch ports │ 802.1X enabled (NAC) │
│ Unused ports │ Shutdown, not disabled │
│ Port security │ Max 2 MACs per port │
│ DHCP snooping │ Prevent rogue DHCP servers │
│ ARP inspection │ Prevent ARP spoofing │
│ MAC flooding │ Port security limits │
│ STP protection │ BPDU guard on access ports │
│ Physical access │ Locked wiring closets │
│ Console ports │ Password-protected │
│ SNMP │ v3 with encryption │
└────────────────────┴─────────────────────────────────┘
ARRIVAL:
1. Visitor arrives at reception
2. Signs in (name, company, contact, host, purpose)
3. Host contacted and confirms
4. Visitor ID checked (government-issued)
5. Visitor badge printed (no photo needed, but dated)
6. Host escorts visitor into office
7. Visitor agreement signed (NDA, security policy)
8. Bag/device policy explained (if applicable)
DURING VISIT:
- Visitor escorted at all times
- No access to restricted areas (server room, secure offices)
- WiFi access via guest network only
- No photography without permission
- Host remains responsible for visitor
DEPARTURE:
1. Visitor returns to reception with host
2. Badge returned and deactivated
3. Sign out (time recorded)
4. Any issued materials returned
Date,Visitor Name,Company,ID Type,ID Number,Host,Purpose,Badge#,Time In,Time Out 2026-07-22,John Smith,ACME Corp,DL,ABC123,JaneDoe,Meeting,001,09:00,11:30 2026-07-22,Sarah Lee,ACME Corp,Passport,XYZ789,JaneDoe,Meeting,002,09:00,11:30 2026-07-22,Mike Brown,TechServ,PASS,B12345,IT Dept,Server Maintenance,003,13:00,17:00
PACKAGE / DELIVERY PROCEDURE:
1. All deliveries received at reception
2. Package screened (visual inspection)
3. Recipient notified via email/Slack
4. Signed for by recipient (log maintained)
5. Sensitive deliveries: Verify recipient identity
6. IT equipment deliveries: Immediately to server room
7. Shredding service: Bonded company, logged collection
CONTRACTOR / MAINTENANCE:
1. Pre-approved vendor list
2. Appointment scheduled (not random)
3. Contractor escorts required
4. Restricted area access requires IT presence
5. Work verified before contractor leaves
6. Access badges deactivated immediately
FIRE SAFETY:
┌────────────────────┬─────────────────────────────────┐
│ Area │ Suppression │
├────────────────────┼─────────────────────────────────┤
│ Open office │ Sprinkler system │
│ Server room │ Clean agent (FM-200 / Novec) │
│ Wiring closets │ Clean agent or sprinkler │
│ Break room │ Sprinkler + fire extinguisher │
│ Kitchenette │ Class K extinguisher (grease) │
│ Throughout │ Smoke detectors + alarms │
└────────────────────┴─────────────────────────────────┘
EMERGENCY PROCEDURES:
- Evacuation routes posted in all areas
- Assembly point designated outside building
- Fire drills quarterly
- Emergency contact cards at every desk
- First aid kits in break room and reception
- AED (defibrillator) in reception area
POWER ARCHITECTURE:
Utility Power
│
┌───┴───┐
│ ATS │ (Automatic Transfer Switch)
└───┬───┘
│
┌───┴───┐ ┌──────────┐
│ UPS │─────│ Generator │ (Natural gas, 24hr fuel)
└───┬───┘ └──────────┘
│
┌───┴────────────┐
│ PDU (rack) │
│ ┌──┐ ┌──┐ │
│ │A │ │B │ │ (Redundant power feeds)
│ └──┘ └──┘ │
└────────────────┘
Runtime: UPS 15 min + Generator unlimited
Monitoring: Automatic alert on power failure
Testing: Monthly UPS test, quarterly generator test
SENSOR PLACEMENT:
┌────────────────┬────────────┬──────────┬────────────┐
│ Location │ Sensors │ Threshold │ Alert │
├────────────────┼────────────┼──────────┼────────────┤
│ Server room │ Temperature│ >75°F │ SMS + Email│
│ Server room │ Humidity │ >60% or <35% │ SMS + Email│
│ Server room │ Smoke/heat │ Detection │ Auto alarm │
│ Wiring closet │ Temperature│ >85°F │ Email │
│ Server room │ Water leak │ Detection │ SMS + Email│
│ Server room │ Power │ Outage │ SMS + Email│
│ Entire office │ CO2 │ >1,000ppm│ Building mgt│
└────────────────┴────────────┴──────────┴────────────┘
| Policy | Description | Owner |
|---|---|---|
| Access Control Policy | Badge issuance, revocation, levels | Facility Manager |
| Clean Desk Policy | No documents left out, screen locked | All employees |
| Visitor Policy | Registration, escorts, badges | Reception |
| Physical Security Policy | Doors, alarms, cameras | Security Team |
| Remote Work Policy | Home office, public WiFi, VPN | IT Manager |
| Data Handling Policy | Paper docs, shredding, storage | DPO |
| Incident Response | Security incident procedures | Security Team |
| Social Engineering Policy | Verification procedures | Security Team |
| Lost/Stolen Equipment | Reporting and response | IT Manager |
CLEAN DESK STANDARDS:
At end of day (and when away from desk for 30+ minutes):
✅ Documents locked in desk drawer or cabinet
✅ Computer locked (Win+L / Ctrl+Cmd+Q)
✅ Mobile device secured (locked, not visible)
✅ Keys and badges secured
✅ Storage media (USB drives) locked away
✅ Post-it notes with passwords — NEVER acceptable
✅ Printers/print jobs collected immediately
❌ NO documents visible on desk
❌ NO unlocked computers
❌ NO passwords written down
❌ NO unattended visitors at desk
❌ NO sensitive discussions in public areas
VISUAL REMINDERS:
Place strategic reminders throughout office:
ENTRANCE: "Welcome! Remember to badge in."
RECEPTION: "All visitors must sign in and be escorted."
OFFICE ENTRANCE: "Is someone behind you? (Tailgating prevention)"
BREAK ROOM: "Lock your screen before your coffee break."
PRINTER: "Collect your documents immediately."
CONFERENCE ROOM: "Wipe the whiteboard. Log out of AV."
EXIT: "Did you take your badge? Don't prop the door!"
SERVER ROOM: "Authorized personnel only — report tailgaters."
| Element | Implementation |
|---|---|
| Security Champion Program | One security-aware employee per team |
| Monthly Security Tips | Rotating posters in break rooms |
| Incident Reporting | Easy button (Slack/Teams) to report |
| Phishing Simulations | Monthly simulated phishing tests |
| Security Newsletter | Quarterly updates and metrics |
| Lunch & Learn | Monthly security topic sessions |
| Security Awards | Recognition for good security practices |
OFFICE DESIGN SUMMARY
═══════════════════════════════════════════
Organization: DataGuard Consulting
Location: 5th Floor, 123 Security Ave
Total Area: 5,000 sq ft
Employees: 40
Design Date: July 2026
ZONES:
┌─────────────────┬─────────┬─────────────┬──────────┐
│ Zone │ Size │ Security Lvl│ Access │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Public │ 400sf │ Public │ Open │
│ (Lobby, conf) │ │ │ │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Open Office │ 2,000sf │ Employee │ Badge │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Private Offices │ 800sf │ Restricted │ Badge + │
│ + Meeting rooms │ │ │ Key │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Support Areas │ 700sf │ Employee │ Badge │
│ (Break room, │ │ │ │
│ storage, etc.) │ │ │ │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Secure Zone │ 500sf │ High Security│ Badge + │
│ (Server, lab, │ │ │ Biometric│
│ wiring closet) │ │ │ │
├─────────────────┼─────────┼─────────────┼──────────┤
│ Building Shared │ 600sf │ Building │ Key fob │
│ (Elevators, │ │ │ │
│ hallways, │ │ │ │
│ restrooms) │ │ │ │
└─────────────────┴─────────┴─────────────┴──────────┘
SECURITY DESIGN ELEMENTS:
Zone-based access control (card + PIN + biometric for server room)
CCTV coverage at all entry points, server room, and common areas
Server room: floor-to-deck walls, steel door, clean agent fire suppression
Dual UPS with generator backup for critical systems
Environmental monitoring (temp, humidity, water leak, power)
Visitor management system (digital sign-in, badge printing)
Privacy screens and cable management at all workstations
🆓 This is a planning-only project — no purchases needed! All work can be done with free tools (draw.io, Google Docs, Google Sheets). The budget section below is for reference if you ever build the office for real. For now, just use the free tools to create your design documents.
If building this office for real, costs would include access control systems, cameras, server room infrastructure, and installation labor. For this project, simply document what you would budget in a spreadsheet — no actual spending required.
| Standard | Requirements | Office Design Impact |
|---|---|---|
| ISO 27001 | A.11 Physical Security | All physical controls documented |
| SOC 2 | Physical Access Controls | Restricted access logging |
| PCI DSS | Requirement 9 | Visitor logs, camera surveillance |
| HIPAA | Administrative, Physical Safeguards | Server room access, workstation security |
| GDPR | Article 32 | Access controls, data storage security |
| NIST SP 800-53 | Physical & Environmental Protection | Full control catalog compliance |
PHYSICAL SECURITY AUDIT CHECKLIST:
[ ] All doors with card readers function correctly
[ ] Server room door closes and locks automatically
[ ] CCTV cameras operational, recording, time-synced
[ ] 30 days of footage available
[ ] No door props in use
[ ] Visitor logs complete and accurate
[ ] No tailgating incidents (last audit period)
[ ] All employees wearing visible badges
[ ] Clean desk policy being followed (spot check)
[ ] Server room temperature within range
[ ] UPS test passed (last 30 days)
[ ] Fire suppression system inspected (within 1 year)
[ ] Emergency lighting tested (within 30 days)
[ ] Shredding/disposal logs complete
[ ] Access review conducted (last 90 days)
Before marking this project complete:
Save your progress and earn XP for completing tutorials.
Keep learning
Technology
Cyber Security & Networking
Lesson group
Projects
Progress
91% complete