Physical Security Assessment Limitations and Assumptions

A physical security assessment can be thorough, professional, and useful without establishing everything a reader might later assume it established.

An assessor may spend a full day on site, interview key personnel, inspect the perimeter, review access control, examine camera coverage, photograph conditions, and produce a well-supported report. Even then, the work may still have important boundaries.

Nighttime lighting may not have been observed. Alarm transmission may have been described but not independently tested. A locked electrical room may have been inaccessible. A sample of access events may have been reviewed rather than the complete history. A tenant may control the office suite while the landlord controls the lobby, loading dock, and exterior cameras. A policy may have been provided as the current version even though the assessor did not independently verify when it took effect.

None of those conditions automatically invalidates the assessment. The problem begins when the report does not make them visible.

A strong assessment record should help a later reader answer two separate questions: What did the assessor establish? and What did the assessor have to assume, sample, rely on, or leave unverified? Limitations and assumptions are how those boundaries stay attached to the conclusions.

A limitation is not an apology

Assessors sometimes treat limitations as defensive boilerplate placed near the end of the report. That wastes their value.

A limitation is simply a condition that affects what the assessment could reasonably establish. Examples include an area that could not be accessed; a control that could not be tested; work performed only during daytime operations; a review limited to selected doors or cameras; a short observation period; incomplete records; unavailable personnel; photography restrictions; restrictions on intrusive or adversarial testing; portions of the property controlled by another entity; systems or disciplines outside the authorized scope; and conditions that changed after the site visit.

Those facts help the reader interpret the findings correctly. Writing them down does not weaken the report. It prevents the report from claiming more than the work supports.

An assumption is something the assessment relies on without independently establishing it

Limitations describe boundaries on the work. Assumptions describe propositions the assessor accepts for purposes of the assessment.

Management may state that the overnight staffing level is two officers. The client may identify a particular drawing as the current floor plan. The access-control administrator may state that credentials are disabled immediately after termination. The facility representative may state that the loading dock is normally locked after 6:00 p.m. A maintenance record may be treated as accurate because independent equipment testing is outside scope.

The assessor may have no reason to doubt those statements. But if a conclusion depends on them, the report should make that dependency visible, especially when the assumption could materially change the risk picture.

Start with scope before writing limitations

Most preventable reporting problems begin with an unclear scope. Before the site visit, define which property, buildings, floors, parking areas, and exterior spaces are included; which security domains are included; which operating periods are relevant; which systems may be reviewed or tested; whether testing is functional, visual, documentary, interview-based, or some combination; whether the engagement includes threat analysis, vulnerability assessment, compliance review, design review, or corrective-action verification; what evidence may be collected; what areas require escort or special authorization; and what is expressly excluded.

A limitation should not have to rescue a scope that was never defined. If cybersecurity of the access-control network is excluded from a physical security engagement, say so in the scope. The scope establishes the planned boundaries. Limitations record what happened inside those boundaries.

Record conditions that affect what was observed

Physical security controls can perform differently depending on time, occupancy, weather, staffing, traffic, lighting, and operating mode. A daytime assessment of a parking area may show camera placement and general coverage, but it may not establish nighttime image quality. A reception process observed at 10:00 a.m. may not reflect shift change, weekend operations, or after-hours access.

That tells the client exactly where the conclusion ends.

Sampling should be described as sampling

Many physical security assessments rely on representative testing. That may be entirely appropriate. The assessor might test selected exterior doors, review a sample of access-control transactions, inspect representative cameras, observe one shift, review selected key-control records, inspect a subset of emergency exits, or examine a sample of visitor records.

The danger is not sampling. The danger is allowing the report to read as though the sample proved the performance of the entire population. If twelve controlled doors were tested, write that twelve controlled doors were tested. If three days of alarm activity were reviewed, identify the period. If the site includes six similar buildings but only two were physically inspected, make that clear.

A sample supports a conclusion about what was sampled. Any broader inference should be identified as an inference, not disguised as complete verification.

Distinguish “not observed,” “not tested,” and “not available”

Not observed means the assessor did not witness the condition during the assessment period. Not tested means the assessor did not perform a functional or deliberate test. Not available means the necessary area, record, person, system, or evidence could not be accessed or provided.

Those distinctions matter. If no alarm occurred while the assessor was on site, that is not the same as testing the alarm. If the client demonstrates an alarm test but the monitoring-center response is not independently verified, that is not the same as end-to-end testing. If the alarm panel is inaccessible to the assessor, that is different again. The report should use language that matches the work.

Separate client-provided information from assessor observation

A physical security assessment often depends on interviews and records supplied by the client. That information can be valuable. It should simply remain identifiable as supplied information.

The same discipline applies to staffing, response times, system retention periods, maintenance practices, training frequency, key inventories, emergency procedures, and other operational facts.

Identify when a finding depends on an assumption

Some assumptions are minor. Others materially affect the conclusion. Suppose a facility has no dedicated guard at a secondary entrance because management states that the entrance remains locked outside scheduled deliveries. If the assessor's conclusion about the adequacy of that entrance depends on the delivery-only assumption, say so.

That tells management which operating assumption must remain true for the conclusion to remain valid.

Do not bury a material limitation in a generic disclaimer

A report may contain a general limitations section. That is useful, but it is not enough when a limitation directly affects a particular finding. If camera coverage was reviewed only during daylight, place that limitation near the camera conclusion. If the assessor could not enter a critical room, say so where that area is discussed. If access-control event history was unavailable, note that in the access-control analysis.

A good practice is: general limitation in the report-level limitations section + specific limitation beside the affected conclusion.

Inaccessible areas should remain visibly unassessed

One of the easiest mistakes is to let an inaccessible area disappear from the report. The assessor could not enter the roof, utility vault, tenant suite, records room, or restricted production space, so the final report simply says nothing about it. Silence can later be misread as “no issue identified.”

If the area is important enough, the assessor can recommend a later validation visit.

Testing restrictions should be explicit

A physical security assessment is not automatically a penetration test. Unless specifically authorized and planned, the assessor may not defeat locks; tailgate employees; present invalid credentials; trigger alarms; disable cameras; attempt forced entry; bypass barriers; test duress devices; manipulate life-safety systems; interfere with normal operations; or create an unsafe condition to see how personnel respond.

That tells the client what “reviewed” actually means.

Shared responsibility can create assessment blind spots

Many sites are not controlled by one organization. A tenant may control employee badges but not the building lobby. A property manager may control exterior lighting but not tenant CCTV. A third-party guard company may operate the security desk. A remote monitoring provider may receive alarms. A corporate team may administer credentials while a local site controls visitor access.

Those boundaries should be recorded because a physical security weakness can sit between organizations. If the assessor evaluates only the tenant-controlled portion, that is a scope boundary. If the assessor relies on another party's description of a shared control, that may be an assumption. If the control cannot be inspected because the third party did not provide access, that is a limitation.

Threat information also has limits

Risk conclusions depend partly on what threats and hazards are considered credible. Threat information can become stale. Incident data may be incomplete. Local conditions may change. The client may define a design-basis threat that is narrower than the assessor would normally consider. The assessment may be focused on physical security and not include a formal intelligence review.

A finding should not be presented as timeless simply because it was reasonable on the date of the assessment.

Avoid vague global assumptions

A sentence such as “The assessor assumes all information provided is accurate” is usually too broad to be useful. It does not tell the reader which information actually matters. A better approach is to identify material assumptions individually: staffing figures provided by the security manager; access-control configuration demonstrated by the system administrator; an after-hours locking procedure the assessment assumes is consistently followed; a floor plan treated as current without field measurement; or a camera-retention period based on configuration information rather than a full retention-period test.

Specific assumptions can be challenged, verified, or updated later. Generic assumptions cannot.

State what would resolve an important uncertainty

Limitations are more useful when they point to the next validation step. If nighttime lighting was not observed, recommend an after-dark verification where the issue matters. If alarm response was not tested, identify whether an authorized end-to-end test would resolve the uncertainty. If a restricted room was inaccessible, recommend a targeted follow-up visit. If access logs were unavailable, identify the records needed. If staffing information was supplied verbally, recommend confirmation against schedules if the conclusion depends on staffing.

This turns a limitation from a dead end into a manageable follow-up item.

A practical limitations-and-assumptions review

1. Scope: Are included and excluded locations, systems, activities, and operating periods clear?
2. Access: Were any requested areas inaccessible or only partially observed?
3. Time and conditions: Could time of day, occupancy, weather, staffing, or operating mode materially affect the observations?
4. Sampling: Did the report clearly identify where testing or record review was based on a sample?
5. Testing: Does the wording distinguish visual review, normal-operation checks, demonstration, and deliberate functional testing?
6. Information source: Can the reader tell which important facts came from interviews or client-supplied records rather than assessor observation?
7. Assumptions: Are material assumptions individually identified rather than hidden in a blanket disclaimer?
8. Dependencies: Does any finding remain valid only if a particular operating assumption continues to be true?
9. Third parties: Are landlord, tenant, contractor, monitoring provider, or corporate/local responsibility boundaries clear?
10. Threat context: Are material threat or operating-context assumptions identified where they influence priority?
11. Uncertainty: Is a material limitation placed near the conclusion it affects?
12. Validation: Where uncertainty matters, does the report identify what additional review or testing would resolve it?

A professional assessment should give the client confidence in what was actually established. It should not create confidence by hiding what remains unknown. That means being willing to write “not observed,” “not tested,” “based on information provided by…,” “sample reviewed,” “outside the authorized scope,” “inaccessible during the assessment,” “assumption requiring validation,” or “condition may warrant reassessment if circumstances change.”

Those phrases do not diminish professional judgment. They show where professional judgment was applied. The most useful physical security report is not the one that sounds the most certain. It is the one that lets a responsible decision-maker understand the evidence, the reasoning, and the boundaries of both.

Sources and further reading

• ASIS International: Security Risk Assessment Standard
• CISA: Security Assessment at First Entry (SAFE)
• CISA: Paper-Based Security Self-Assessment and User Guide