📋 Managerial Controls for Physical Security
Policies and procedures that govern who can access what — and when⏱ ~2 min
A hospital uses badge access to control who enters the medication room (physical security) and also encrypts patient records (cybersecurity). These aren't separate problems — they protect the same assets. A thief who steals a laptop bypasses all your encryption if the drive isn't encrypted at rest. Physical and digital controls must work together; neither is sufficient alone.
What Are Managerial Controls?
Managerial controls are the administrative policies, procedures, and training that govern physical security. They're not the cameras or locks themselves — they're the rules that decide where cameras go, who gets keys, what happens when a badge is lost, and how employees are trained to respond to security incidents.
Key Managerial Control Categories
| Control Type | What It Does | Examples |
|---|---|---|
| Security Awareness Training | Educates employees to recognize and respond to physical threats | Tailgating recognition, social engineering scenarios, what to do if you find a USB drive |
| Business Continuity Policies | Plans for maintaining operations if physical security is breached | Backup site, data backup procedures, incident response chain of command |
| Physical Security Policies | Formal rules governing facility access, visitor management, and asset handling | Visitor log, escort requirements, clean desk policy, ID badge requirements |
| Workstation Security Policies | Rules for securing devices when not in use | Auto-lock after 5 minutes idle, full-disk encryption required, no personal USB devices |
| Access Control Lists | Documented lists of who is authorized to access specific areas | Only Finance staff may access the accounting server room; contractors require escort |
| Risk Assessment | Regular evaluation of physical vulnerabilities and their likelihood/impact | Annual physical penetration test, facility security audit, threat modeling |
Workstation Security Policy — Why It Matters
- •Auto-lock — screen locks after 5 minutes idle; short enough to matter, long enough to not be annoying
- •Full-disk encryption — if a laptop is stolen, the thief gets an encrypted brick without the login credential
- •Password policy — minimum length, complexity, rotation period, no reuse
- •USB device policy — block unauthorized USB devices at the OS level; only IT-issued devices allowed
- •Clear screen / clean desk — no sensitive documents visible; physical shredding of all paper
- •No tailored software — only IT-approved software; prevents USB-dropped malware from being installed
- •Backup verification — regular tests that backups actually restore; a backup you've never tested is not a backup
It's 4 PM and the lab is empty for 20 minutes before the next class. You walk by and notice: - A computer is logged in with a student dashboard open (grades visible) - A sticky note on the monitor reads 'Password: lakers2024!' - A USB drive is plugged in labeled 'homework' - A printed report card is sitting face-up on the keyboard - The door to the lab is propped open with a chair
- ⚑Unlocked computer with student data visible — violates auto-lock / screen-lock policy
- ⚑Password written on a sticky note — violates password security policy
- ⚑Unknown USB drive plugged in — violates USB device policy (potential malware vector)
- ⚑Printed grade report unattended — violates FERPA and clean desk policy
- ⚑Door propped open — eliminates physical access control; anyone can walk in
A company creates a policy requiring that all employees must shred sensitive documents, lock workstations when leaving desks, and challenge any unescorted visitors. An attacker successfully enters the building anyway by tailgating, but finds all computers locked and all documents shredded. What has the managerial control achieved?