🏠 Physical Security Skill

🎯 Purpose

This skill enforces physical security controls for home office environments, equipment protection, and environmental security. Based on Hack23 AB's Physical Security Policy, it demonstrates how enterprise-grade physical security is achievable for remote-first operations.

Key Principle: Physical security isn't just locks and guards—it's layered protection for remote work environments where traditional perimeter security doesn't exist.

📚 Scope

This skill covers:

• 🏠 Home Office Security: Workspace protection, access control, secure storage

• 💻 Equipment Protection: Laptops, monitors, mobile devices, storage media

• 👥 Visitor Management: Guest access controls for home office environment

• 🌡️ Environmental Security: Fire, water, temperature, humidity protection

• 🧹 Clean Desk/Screen Policy: Information exposure prevention

• 🔒 Physical Access Controls: Device locks, secure storage, theft prevention

⚙️ Security Rules

MUST Requirements

Physical security controls you MUST implement:

🏠 Workspace Security

home_office_requirements: dedicated_workspace: required lockable_door: recommended window_security: blinds_or_curtains_required visitor_visibility: minimize_screen_visibility secure_storage: lockable_cabinet_or_drawer backup_media: fireproof_safe_or_offsite_storage

💻 Equipment Protection

device_security: laptops: - physical_lock_cable: when_in_public_spaces - full_disk_encryption: mandatory - screen_privacy_filter: recommended_for_sensitive_work - automatic_screen_lock: 5_minutes_idle_maximum - boot_password: BIOS/UEFI_password_required

mobile_devices: - screen_lock: biometric_or_strong_PIN - device_encryption: mandatory - remote_wipe_capability: enrolled_in_MDM - physical_protection: use_protective_case

storage_media: - encryption: all_removable_media_encrypted - labeling: classification_labels_applied - secure_storage: locked_cabinet_when_not_in_use - disposal: secure_wipe_or_physical_destruction

🌡️ Environmental Controls

environmental_protection: fire_safety: - smoke_detectors: installed_and_tested_monthly - fire_extinguisher: accessible_and_inspected - evacuation_plan: documented_and_practiced - electrical_safety: no_overloaded_circuits

water_damage: - equipment_placement: elevated_off_floor - leak_detection: water_sensors_near_equipment - backup_protection: waterproof_bags_for_critical_items

climate_control: - temperature_range: 15-25°C_optimal - humidity_control: 30-60%_relative_humidity - ventilation: adequate_airflow_for_equipment

🧹 Clean Desk/Screen Policy

information_protection: end_of_day: - lock_sensitive_documents: secure_cabinet_or_safe - secure_removable_media: encrypted_and_locked_away - log_out_of_systems: all_sessions_terminated - screen_lock: automatic_lock_enabled - shred_confidential_waste: cross_cut_shredder

during_work: - minimize_paper: digital_first_approach - classify_documents: apply_classification_labels - visitor_awareness: hide_sensitive_information - screen_positioning: away_from_windows_and_visitors

👥 Visitor Management

home_office_visitors: before_visit: - schedule_visitors: avoid_overlap_with_sensitive_work - prepare_workspace: secure_all_confidential_materials - screen_positioning: ensure_no_visibility_of_work

during_visit: - lock_screens: all_devices_locked - escort_required: visitor_never_left_alone_in_workspace - conversation_awareness: avoid_discussing_confidential_matters

after_visit: - verify_security: check_all_devices_and_documents_secure - access_review: review_system_access_logs_if_visitor_near_devices

MUST NOT Prohibitions

Physical security practices you MUST NOT do:

❌ Equipment Exposure

prohibited_practices:

• leave_devices_unlocked: in_public_or_shared_spaces

• work_in_public: with_sensitive_data_visible_to_others

• store_devices_visibly: in_vehicles_or_unsecured_locations

• share_workspace: with_unauthorized_individuals_during_sensitive_work

• leave_doors_unlocked: when_workspace_contains_business_equipment

❌ Information Exposure

prohibited_behaviors:

• print_unnecessary_documents: use_digital_workflows_instead

• leave_documents_unattended: always_secure_or_destroy

• discuss_confidential_matters: in_public_or_with_visitors_present

• dispose_unsecurely: regular_trash_for_sensitive_documents

• store_passwords_physically: written_passwords_in_visible_locations

❌ Unsafe Practices

dangerous_behaviors:

• overload_circuits: multiple_high_power_devices_on_one_outlet
• block_exits: equipment_blocking_emergency_egress
• ignore_alarms: smoke_detector_or_security_system_alerts
• disable_protection: removing_security_cables_or_locks
• unsecured_backup_media: leaving_backup_drives_visible_or_unlocked

💡 Examples

Example 1: Home Office Setup (Compliant)

Scenario: Setting up a secure home office workspace for cybersecurity consulting work.

Home Office Security Configuration

workspace_security: location: room: dedicated_home_office door: lockable_from_inside windows: - privacy_film_applied: true - blinds_installed: true - desk_positioned: perpendicular_to_window

equipment: primary_workstation: device: Ubuntu_22.04_LTS_laptop security: - full_disk_encryption: LUKS_enabled - BIOS_password: configured - physical_lock_cable: attached_to_desk - screen_privacy_filter: installed

monitors:
  count: 2
  positioning: facing_away_from_door_and_windows
  privacy: screen_not_visible_from_hallway

mobile_devices:
  - iPhone_with_MDM: biometric_lock_enabled
  - iPad: encrypted_and_screen_locked

storage: secure_cabinet: type: lockable_metal_filing_cabinet contents: - backup_drives: encrypted_USB_drives - client_contracts: physical_copies_locked - hardware_tokens: YubiKeys_secured

fireproof_safe:
  contents:
    - critical_backups: offline_encrypted_backups
    - emergency_contacts: printed_emergency_procedures

environmental: fire_protection: - smoke_detectors: 2_units_tested_monthly - fire_extinguisher: ABC_rated_inspected_annually

climate_control:
  - temperature: thermostat_set_20°C
  - humidity: dehumidifier_maintains_45%_RH

power_protection:
  - UPS: 1500VA_battery_backup_for_workstation
  - surge_protection: all_devices_on_surge_protectors

clean_desk_policy: daily_routine: - end_of_day: all_documents_locked_in_cabinet - screen_lock: automatic_after_5_minutes - shredding: cross_cut_shredder_for_sensitive_waste

Result: ✅ Compliant - Comprehensive physical security controls for home office

ISO 27001:2022 Mapping:

• A.7.4: Physical security monitoring

• A.7.9: Security of assets off-premises

• A.7.13: Clear desk and clear screen

Example 2: Visitor Access Control (Compliant)

Scenario: Client visiting home office for project kick-off meeting.

Visitor Management Procedure

visitor_access_control: pre_visit_preparation: schedule: date: 2026-02-15 time: 10:00-12:00 visitor: client_representative

security_actions:
  - review_calendar: no_overlapping_sensitive_work
  - secure_materials:
      - lock_client_contracts: all_other_clients_secured
      - close_applications: client_systems_logged_out
      - position_screens: face_away_from_guest_seating
  - prepare_meeting_area:
      - clean_desk: no_documents_visible
      - lock_cabinets: filing_cabinet_secured
      - test_screen_lock: automatic_lock_verified

during_visit: physical_controls: - workspace_access: visitor_not_allowed_in_office_area - meeting_location: living_room_separate_from_workspace - screen_status: all_devices_locked_before_meeting - door_closed: office_door_closed_and_locked

behavioral_controls:
  - conversation_topics: project_scope_only_no_other_clients
  - document_handling: only_visitor_specific_materials_shown
  - device_access: visitor_devices_not_connected_to_network
  - escort_policy: visitor_escorted_if_bathroom_access_needed

post_visit: verification_checklist: - physical_security: - devices_still_locked: verified - documents_secured: filing_cabinet_still_locked - no_items_left_behind: workspace_checked - access_review: - system_logs: no_unauthorized_access_detected - network_connections: no_unknown_devices_connected - follow_up: - meeting_notes: sensitive_details_encrypted - next_steps: documented_in_project_tracker

Result: ✅ Compliant - Proper visitor management with information protection

ISO 27001:2022 Mapping:

• A.7.1: Physical security perimeters

• A.7.2: Physical entry

• A.7.13: Clear desk and clear screen

Example 3: Equipment Loss Prevention (Non-Compliant → Corrected)

Scenario: Laptop left unattended in coffee shop while working remotely.

❌ Non-Compliant Practice:

INCORRECT - Physical Security Violation

coffee_shop_work: laptop_security: - screen_lock: disabled_for_convenience - physical_security: left_on_table_while_ordering_coffee - confidential_work: client_contract_visible_on_screen - location: public_coffee_shop_with_high_traffic

Problems:

• ❌ Device left unattended in public space

• ❌ Screen lock disabled exposing confidential information

• ❌ No physical security (cable lock) used

• ❌ Sensitive work performed in public location

✅ Corrected Approach:

CORRECT - Secure Remote Work Practices

remote_work_policy: location_assessment: - evaluate_sensitivity: client_contract_work_is_HIGH_classification - decision: work_from_home_office_only_for_sensitive_tasks

public_space_work: allowed_activities: - general_research: non_client_specific_industry_research - email_review: non_confidential_communications_only - code_review: public_open_source_projects_only

required_controls:
  - screen_privacy_filter: prevents_shoulder_surfing
  - VPN_connection: always_enabled_for_business_access
  - screen_lock: automatic_after_2_minutes_in_public
  - physical_security: laptop_never_left_unattended
  - positioning: back_to_wall_screen_not_visible_to_others

prohibited_activities:
  - client_contracts: no_confidential_documents_in_public
  - sensitive_data: no_HIGH_or_CRITICAL_data_access
  - production_systems: no_administrative_access_from_public_wifi

device_protection: - physical_lock_cable: attached_when_in_public_spaces - screen_lock: automatic_and_immediate_when_leaving_seat - backup_awareness: work_saved_to_cloud_before_leaving_home

Result: ✅ Corrected - Appropriate controls for remote work based on data sensitivity

Classification Impact:

• 🔴 Critical/High Data: Work from home office only with full security controls

• 🟡 Medium Data: Public spaces with screen privacy filter and VPN

• 🟢 Low/Public Data: Public spaces with basic security awareness

🔗 Integration Points

ISMS Policy Integration

This skill implements controls from:

• Physical Security Policy - Home office security framework

• Asset Register - Equipment inventory and classification

• Information Security Policy - Overall security framework

• Classification Framework - Data sensitivity levels

• Incident Response Plan - Device loss/theft procedures

Related Security Skills

• cryptography - Encryption requirements for devices and storage media

• data-classification - Information sensitivity and handling requirements

• mobile-device-management - Mobile device security controls

• access-control - Authentication and authorization for devices

Compliance Frameworks

ISO 27001:2022 Controls:

• A.7.1 - Physical security perimeters (home office boundary definition)

• A.7.2 - Physical entry (visitor management and access control)

• A.7.4 - Physical security monitoring (environmental and equipment monitoring)

• A.7.9 - Security of assets off-premises (remote work equipment protection)

• A.7.13 - Clear desk and clear screen (information exposure prevention)

• A.7.14 - Secure disposal or re-use of equipment (secure destruction procedures)

NIST CSF 2.0 Functions:

• PR.AC-01 - Physical access to assets is managed and protected

• PR.DS-01 - Data-at-rest is protected (encrypted storage media)

• PR.IP-06 - Data is destroyed according to policy (secure disposal)

• PR.PT-02 - Removable media is protected (encrypted and secured)

CIS Controls v8.1:

• 1.1 - Establish and maintain detailed enterprise asset inventory (equipment tracking)

• 3.6 - Securely manage enterprise assets and data (physical security controls)

• 10.7 - Use behavior-based anti-malware software (environmental threat detection)

• 12.8 - Define and maintain role-based access control (visitor management)

🎯 Best Practices

Home Office Security Checklist

Daily Security Routine

Start of Day:

• Verify workspace door is locked
• Check environmental controls (smoke detector, temperature)
• Boot devices with BIOS password
• Verify screen privacy filter is clean and positioned correctly
• Check UPS battery status

During Work:

• Lock screen when leaving workspace
• Position screens away from windows and hallways
• Secure documents immediately after use
• Shred sensitive waste in cross-cut shredder
• Escort visitors if they need access to home during work hours

End of Day:

• Log out of all systems
• Lock all devices with cable locks or in secure storage
• Secure all documents in lockable cabinet
• Secure backup media in fireproof safe
• Verify all windows and doors locked
• Set alarm system if available

Equipment Protection Matrix

Device Type Physical Security Encryption Access Control Backup

💻 Laptop Cable lock + locked office LUKS full disk BIOS password + screen lock Daily to AWS S3

📱 Mobile Physical case + MDM Device encryption Biometric + PIN iCloud/Google backup

💾 USB Drive Locked cabinet BitLocker/LUKS Password protected Not primary storage

🖥️ Desktop Locked office + bolted desk LUKS full disk BIOS password + screen lock Daily to AWS S3

⌚ Smart Watch Physical security + MDM Device encryption PIN/Biometric Synced to phone

Environmental Monitoring

Recommended Environmental Sensors

home_office_monitoring: fire_detection: - smoke_detectors: 2_units_interconnected - heat_detectors: 1_unit_above_equipment - testing_schedule: monthly_button_test

water_damage: - water_sensors: under_AC_units_and_near_windows - leak_detection: near_water_heater_if_adjacent - alert_method: SMS_notification_to_phone

climate: - temperature_sensor: smart_thermostat_with_alerts - humidity_sensor: standalone_hygrometer - alert_thresholds: - temperature: below_15°C_or_above_30°C - humidity: below_25%_or_above_70%

power: - UPS_monitoring: software_alerts_for_power_events - surge_protection: LED_indicators_on_surge_protectors - generator: optional_for_critical_infrastructure

📊 Risk Mitigation

Physical Security Threats

Threat Impact Likelihood Risk Level Mitigation

Device Theft 🔴 Critical 🟡 Medium 🔴 High Cable locks, locked office, encryption

Fire Damage 🔴 Critical 🟢 Low 🟡 Medium Smoke detectors, fire extinguisher, offsite backups

Water Damage 🟠 High 🟡 Medium 🟠 High Elevated equipment, water sensors, waterproof bags

Visitor Snooping 🟠 High 🟡 Medium 🟠 High Clean desk policy, screen positioning, visitor escort

Environmental 🟡 Medium 🟡 Medium 🟡 Medium Climate control, humidity monitoring, UPS

Power Loss 🟡 Medium 🟠 High 🟡 Medium UPS backup, surge protection, saved work

Shoulder Surfing 🟡 Medium 🟠 High 🟠 High Screen privacy filters, positioning, awareness

Incident Response

Device Loss/Theft:

• Immediately report to CEO (self-reporting for single-person company)

• Remote wipe device if MDM capable (see Mobile Device Management Policy)

• Change all passwords accessed from device

• Report to police if theft suspected

• Review access logs for unauthorized activity

• Update Asset Register

Fire/Water Damage:

• Ensure personal safety first

• Contact emergency services if necessary

• Document damage with photos

• Recover equipment if safe to do so

• Assess data recovery options

• Restore from backups per Backup Recovery Policy

• File insurance claim if applicable

🔍 Validation & Testing

Physical Security Audit

#!/bin/bash

Physical Security Self-Assessment Script

echo "🏠 Hack23 AB - Physical Security Audit" echo "========================================" echo ""

Workspace Security

echo "📋 Workspace Security Checklist:" read -p "Is workspace in a lockable room? (yes/no): " lockable_room read -p "Are windows covered with blinds/film? (yes/no): " window_privacy read -p "Is secure storage (cabinet/safe) available? (yes/no): " secure_storage read -p "Are screens positioned away from windows/doors? (yes/no): " screen_position

Equipment Protection

echo "" echo "💻 Equipment Protection Checklist:" read -p "Are laptops using full disk encryption? (yes/no): " disk_encryption read -p "Are cable locks used for equipment? (yes/no): " cable_locks read -p "Are mobile devices enrolled in MDM? (yes/no): " mdm_enrolled read -p "Is automatic screen lock enabled (<5 min)? (yes/no): " screen_lock

Environmental Controls

echo "" echo "🌡️ Environmental Controls Checklist:" read -p "Are smoke detectors installed and tested? (yes/no): " smoke_detectors read -p "Is fire extinguisher accessible and inspected? (yes/no): " fire_extinguisher read -p "Is equipment elevated off floor? (yes/no): " elevated_equipment read -p "Is UPS/surge protection installed? (yes/no): " power_protection

Clean Desk Policy

echo "" echo "🧹 Clean Desk Policy Checklist:" read -p "Are documents locked at end of day? (yes/no): " documents_secured read -p "Is cross-cut shredder available? (yes/no): " shredder_available read -p "Are backup media secured in safe/cabinet? (yes/no): " backup_secured

Calculate compliance score

score=0 total=13

[[ "$lockable_room" == "yes" ]] && ((score++)) [[ "$window_privacy" == "yes" ]] && ((score++)) [[ "$secure_storage" == "yes" ]] && ((score++)) [[ "$screen_position" == "yes" ]] && ((score++)) [[ "$disk_encryption" == "yes" ]] && ((score++)) [[ "$cable_locks" == "yes" ]] && ((score++)) [[ "$mdm_enrolled" == "yes" ]] && ((score++)) [[ "$screen_lock" == "yes" ]] && ((score++)) [[ "$smoke_detectors" == "yes" ]] && ((score++)) [[ "$fire_extinguisher" == "yes" ]] && ((score++)) [[ "$elevated_equipment" == "yes" ]] && ((score++)) [[ "$power_protection" == "yes" ]] && ((score++)) [[ "$documents_secured" == "yes" ]] && ((score++)) [[ "$backup_secured" == "yes" ]] && ((score++))

compliance_percentage=$((score * 100 / total))

echo "" echo "========================================" echo "📊 Compliance Score: $score/$total ($compliance_percentage%)" echo ""

if [ $compliance_percentage -ge 90 ]; then echo "✅ EXCELLENT - Physical security controls are comprehensive" elif [ $compliance_percentage -ge 70 ]; then echo "⚠️ GOOD - Minor improvements needed" elif [ $compliance_percentage -ge 50 ]; then echo "⚠️ FAIR - Significant gaps exist, immediate action required" else echo "❌ POOR - Critical physical security deficiencies" fi

echo "" echo "📝 Document findings in Security Metrics and Asset Register" echo "🔄 Schedule remediation for any 'no' responses"

Monthly Security Review

Physical Security Monthly Review Checklist

Date: [YYYY-MM-DD]
Reviewer: CEO

Equipment Inventory

• Verify all devices in Asset Register are accounted for
• Check encryption status on all laptops and storage media
• Test screen locks and BIOS passwords
• Inspect cable locks for damage or tampering
• Verify mobile device MDM enrollment status

Environmental Systems

• Test smoke detectors (button test)
• Inspect fire extinguisher pressure gauge
• Check UPS battery status and runtime test
• Test water sensors if installed
• Review climate control (temperature/humidity logs)

Workspace Security

• Verify lockable cabinet is functional
• Inspect fireproof safe for damage
• Check window coverings for damage or gaps
• Assess screen positioning for visitor visibility
• Review clean desk policy compliance

Visitor Management

• Review visitor log (if any visits occurred)
• Assess visitor access procedures effectiveness
• Update visitor management procedures if needed

Remediation Actions

• Document any deficiencies found
• Assign remediation tasks with deadlines
• Update Asset Register with any changes
• Schedule next monthly review

🎓 Training & Awareness

Physical Security Principles

Layered Protection Approach:

• Perimeter Security: Home office boundary (locked doors, windows secured)

• Equipment Security: Device locks, encryption, screen privacy

• Information Security: Clean desk policy, secure disposal, classification awareness

• Environmental Security: Fire/water/climate protection

• Behavioral Security: Visitor awareness, situational awareness, incident reporting

Security Culture:

• Physical security is everyone's responsibility (even in single-person company)

• "If you see something, say something" applies to physical threats too

• Security controls are not obstacles—they protect business continuity

• Transparency in security practices demonstrates professional maturity

Resources

• Physical Security Policy: View on GitHub

• Asset Register: View on GitHub

• ISO 27001:2022 A.7: Physical and environmental security controls

• NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems

📋 Document Control

Skill Metadata:

• Version: 1.0

• Last Updated: 2026-02-10

• Review Cycle: Annual

• Owner: Hack23 AB Security Team

• Classification:

Framework Compliance:

License: Apache-2.0

Repository: https://github.com/Hack23/homepage