From Observation to Finding: Structuring a Physical Security Assessment

A physical-security assessment can go wrong even when the site visit itself was done well. The assessor may have noticed the right things, taken plenty of photographs and spoken with the right people. The trouble often comes later, when all of that field information has to be turned into something useful.

A photograph gets separated from the note that explains it. An observation becomes a finding without much explanation of why the condition matters. A recommendation appears in the report, but it is difficult to tell exactly which problem it is supposed to correct.

By the time the report is finished, the assessor may understand all of the connections because they were there. The client may not. That is why a good assessment record needs a clear path from what was seen in the field to what eventually appears in the report.

Start with the assignment, not the checklist

Before walking the property, be clear about what you are actually assessing.

A client may ask for a “physical security assessment,” but that phrase can cover a lot of ground. Are you reviewing the perimeter? Employee entrances? Visitor control? CCTV coverage? Lighting? Key management? Security staffing? Critical areas inside the building?

Just as important, what are you not assessing?

Writing that down at the beginning prevents trouble later. It gives the assessor a boundary for the work and helps the client understand what conclusions can reasonably be drawn from the report.

Write down what you saw before deciding what it means

It helps to keep an observation separate from a finding.

Suppose an assessor finds an employee entrance unlocked at 2:20 in the afternoon.

The finding comes next. It explains the significance.

Those statements do different jobs. The first preserves what actually happened in the field. The second applies professional judgment to it. Keeping the distinction clear reduces the chance that interpretation quietly becomes part of the original observation.

A photograph needs a story attached to it

Most assessors have seen a folder full of photographs with filenames such as IMG_4827.jpg.

Six months later, that photograph may still be perfectly clear and almost useless. Where was it taken? Which door is that? Is the picture showing a failed lock, inadequate lighting, vegetation blocking a camera view, or something else entirely?

The useful part of a photograph is not just the image. It is the context around it. At a minimum, the assessment record should make it possible to determine where the photograph was taken, what it was intended to show, and which observation or finding it supports.

If a working copy is later cropped, annotated or enhanced, it should also remain possible to distinguish that version from the original photograph.

Explain the risk rather than hiding behind a rating

“High risk” is not much of an explanation. Neither is “moderate vulnerability.”

A rating can be useful, particularly when an assessment methodology calls for one, but the person reading the report should not have to guess why the assessor assigned it.

What asset or function is exposed? What existing controls are present? What is the weakness in those controls? What could reasonably happen if the condition is exploited? Are there compensating measures that reduce the concern?

The purpose is not to make every finding several pages long. It is to record enough reasoning that another qualified person can follow the assessor's thinking.

Write findings so another professional can follow them

A strong finding should tell the reader what condition exists, where it exists, why it matters, and what supports the conclusion. The client should not have to reconstruct the fieldwork from scattered notes and photographs just to understand the report.

The objective is not length. It is traceability.

Recommendations should solve identifiable problems

Generic recommendations weaken otherwise good reports.

“Improve access control.” “Enhance surveillance.” “Review security procedures.” Those statements may all be true, but they leave the client to do much of the analytical work the assessment was supposed to provide.

A useful recommendation connects directly to a finding. If an employee entrance is not reliably controlled, the recommendation should address that access point and the reason it is vulnerable. The client may still decide exactly how to implement the recommendation. That is different from leaving the client to figure out what the recommendation means.

A visible path should remain:

Don't erase the problem after it has been fixed

Corrective action is good news. It should not rewrite the original assessment.

If a defective door is repaired three weeks later, the assessment record should still show that the problem existed when the site was assessed. The repair becomes the next part of the history.

The record can then show the original condition, the finding, the recommendation, the corrective action and, where appropriate, verification that the corrective action was completed.

Try working backward through your own report

One of the simplest quality checks comes at the end. Pick an important finding from the final report and work backward.

Can you locate the recommendation associated with it? Can you see why the condition was considered a risk? Can you find the photograph, note or other information supporting the finding? Can you get all the way back to the original field observation?

If you cannot, the client may have the same problem.

A strong physical-security assessment is not simply a list of things that are wrong. It is a connected record showing what was observed, why it mattered, what should be done about it and what happened afterward.

Sources and further reading

• CISA: Security Assessment at First Entry
• CISA: Government Facilities Sector-Specific Plan