Physical access, visitor and protective systems assessment
Assess physical access and protective systems to set improvement priorities
Understand gaps in visitor handling, access practices and existing protective systems. ICA's scoped onsite review connects control gaps and coverage observations to practical operating priorities for facilities, security and IT owners.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide where existing protections need attention
Visitor handling varies between entrances. Access permissions are difficult to explain. Aging cameras or alarms raise questions about coverage, but replacing equipment is a significant decision. Facilities and corporate security teams need a clearer account of the gaps before choosing their next investment.
Findings help distinguish procedural improvements from issues that need a separate equipment or engineering decision.
Connect visitor practices with protective-system coverage
The agreed scope covers visitor controls, physical access management practices, camera coverage, alarms and protective-system operating procedures. Relevant workflows may include approving a visitor, issuing access, managing exceptions and ending access when it is no longer needed. The review considers how those practices work at the selected facilities.
System types and site arrangements shape coverage. A reception desk, a shared building entrance and an employee-only area may have different owners and operating constraints. Scoping identifies the locations and systems to examine, the evidence available and any areas outside the review. Landlord-managed protections require clear access and responsibility arrangements.
Review systems and procedures without intrusive testing
The proposed method is an onsite system and process review. Walkthrough observations and discussions with responsible staff are considered alongside available procedures and system evidence. For example, visitor instructions can be compared with the observed entry process. Camera coverage can be reviewed against the areas your team expects it to cover.
Evidence may include access approval records, system inventories, coverage documentation and alarm-handling procedures. The review distinguishes what was observed from what staff describe or records support. Missing evidence is recorded as a limitation. The base scope excludes intrusive system testing; it does not establish performance under an attack or every operating condition.
Use findings to assign operational priorities
Typical outputs are agreed in the engagement scope. Each serves a different part of the improvement discussion:
Control gap report: Documents identified weaknesses in the reviewed visitor, access and protective-system practices. Owners can use the findings to explain where procedures or responsibilities need attention.
Coverage observations: Describe the protective coverage examined and relevant gaps or uncertainties. These observations inform further investigation without becoming a certified design or engineering specification.
Operational improvement priorities: Set out recommended actions in priority order. Leadership can use them to discuss ownership, operating changes and the need for separately scoped specialist work.
The outputs provide a planning basis for your team. Implementation and validation of completed changes remain separate decisions.
Establish site access and evidence before the review
Facilities, system types and evidence availability determine the engagement's effort, cost and timing. Scoping also establishes which operating periods matter, who controls each system and what can be observed safely. The objective might be inconsistent visitor handling, access concerns or uncertainty about aging protections; that objective guides the agreed review depth.
Identify people who manage reception, physical access and protective systems. Property management and IT participation may be needed where responsibilities overlap. Prepare available procedures and relevant system documentation, then agree how sensitive materials will be handled. Site permission and safety arrangements should be clear before onsite work. Any unavailable evidence or restricted area limits the conclusions that can be drawn.
Keep advisory review separate from engineering and testing
This assessment focuses on existing controls and their operation. Installation is outside the base scope. Intrusive system testing requires a separate agreement, and the review does not provide certified engineering or establish code compliance.
A broader facility threat and vulnerability assessment considers wider site conditions. A physical adversarial assessment addresses a different question about performance under an authorized challenge and requires separate scope and rules of engagement. Guard services, operational protection and continuous monitoring are outside this advisory review. Your team can use the recommendations to decide which additional work is appropriate without assuming it is included.
Questions about the assessment
Who is this assessment for?
Facilities, corporate security, IT and property management teams with concerns about physical access, visitor handling or existing protective systems. It fits a decision about improving current controls rather than buying an installation service.
Can the review cover more than one facility?
Facilities and coverage are established during scoping. Different system types, building owners and access arrangements affect the review. Findings apply to the agreed locations and evidence examined, rather than every site by default.
What evidence helps explain the findings?
Available procedures, access approval records, system inventories and coverage documentation can support onsite observations and staff discussions. The agreed scope determines the evidence needed. Gaps in access or documentation are identified as limits on the review.
What determines cost and timing?
The number of facilities, system types and available evidence are core factors. Site access, operating constraints and the participation needed from system owners also affect effort. These details must be agreed before cost and timing are confirmed.
Does this include covert entry or an attack simulation?
The base engagement is a system and process review. Adversarial physical testing is separately scoped and requires written authorization, agreed ownership and rules of engagement. Review findings should not be treated as evidence from an attack simulation.
Will ICA install equipment or certify the systems?
The typical outputs are a control gap report, coverage observations and operational improvement priorities. Installation and intrusive system testing are outside the base scope. This assessment does not provide certified engineering or a code-compliance determination.
Set priorities for the protections you already have
Discuss a scoped review of the visitor practices, access controls and protective systems causing concern. A defined coverage boundary and documented findings give facilities, security and IT owners a common basis for deciding which operating improvements and further specialist work deserve attention.
Decide where existing protections need attention
Visitor handling varies between entrances. Access permissions are difficult to explain. Aging cameras or alarms raise questions about coverage, but replacing equipment is a significant decision. Facilities and corporate security teams need a clearer account of the gaps before choosing their next investment.
Findings help distinguish procedural improvements from issues that need a separate equipment or engineering decision.
Connect visitor practices with protective-system coverage
The agreed scope covers visitor controls, physical access management practices, camera coverage, alarms and protective-system operating procedures. Relevant workflows may include approving a visitor, issuing access, managing exceptions and ending access when it is no longer needed. The review considers how those practices work at the selected facilities.
System types and site arrangements shape coverage. A reception desk, a shared building entrance and an employee-only area may have different owners and operating constraints. Scoping identifies the locations and systems to examine, the evidence available and any areas outside the review. Landlord-managed protections require clear access and responsibility arrangements.
Review systems and procedures without intrusive testing
The proposed method is an onsite system and process review. Walkthrough observations and discussions with responsible staff are considered alongside available procedures and system evidence. For example, visitor instructions can be compared with the observed entry process. Camera coverage can be reviewed against the areas your team expects it to cover.
Evidence may include access approval records, system inventories, coverage documentation and alarm-handling procedures. The review distinguishes what was observed from what staff describe or records support. Missing evidence is recorded as a limitation. The base scope excludes intrusive system testing; it does not establish performance under an attack or every operating condition.
Use findings to assign operational priorities
Typical outputs are agreed in the engagement scope. Each serves a different part of the improvement discussion:
Control gap report: Documents identified weaknesses in the reviewed visitor, access and protective-system practices. Owners can use the findings to explain where procedures or responsibilities need attention.
Coverage observations: Describe the protective coverage examined and relevant gaps or uncertainties. These observations inform further investigation without becoming a certified design or engineering specification.
Operational improvement priorities: Set out recommended actions in priority order. Leadership can use them to discuss ownership, operating changes and the need for separately scoped specialist work.
The outputs provide a planning basis for your team. Implementation and validation of completed changes remain separate decisions.
Establish site access and evidence before the review
Facilities, system types and evidence availability determine the engagement's effort, cost and timing. Scoping also establishes which operating periods matter, who controls each system and what can be observed safely. The objective might be inconsistent visitor handling, access concerns or uncertainty about aging protections; that objective guides the agreed review depth.
Identify people who manage reception, physical access and protective systems. Property management and IT participation may be needed where responsibilities overlap. Prepare available procedures and relevant system documentation, then agree how sensitive materials will be handled. Site permission and safety arrangements should be clear before onsite work. Any unavailable evidence or restricted area limits the conclusions that can be drawn.
Keep advisory review separate from engineering and testing
This assessment focuses on existing controls and their operation. Installation is outside the base scope. Intrusive system testing requires a separate agreement, and the review does not provide certified engineering or establish code compliance.
A broader facility threat and vulnerability assessment considers wider site conditions. A physical adversarial assessment addresses a different question about performance under an authorized challenge and requires separate scope and rules of engagement. Guard services, operational protection and continuous monitoring are outside this advisory review. Your team can use the recommendations to decide which additional work is appropriate without assuming it is included.
Questions about the assessment
Who is this assessment for?
Facilities, corporate security, IT and property management teams with concerns about physical access, visitor handling or existing protective systems. It fits a decision about improving current controls rather than buying an installation service.
Can the review cover more than one facility?
Facilities and coverage are established during scoping. Different system types, building owners and access arrangements affect the review. Findings apply to the agreed locations and evidence examined, rather than every site by default.
What evidence helps explain the findings?
Available procedures, access approval records, system inventories and coverage documentation can support onsite observations and staff discussions. The agreed scope determines the evidence needed. Gaps in access or documentation are identified as limits on the review.
What determines cost and timing?
The number of facilities, system types and available evidence are core factors. Site access, operating constraints and the participation needed from system owners also affect effort. These details must be agreed before cost and timing are confirmed.
Does this include covert entry or an attack simulation?
The base engagement is a system and process review. Adversarial physical testing is separately scoped and requires written authorization, agreed ownership and rules of engagement. Review findings should not be treated as evidence from an attack simulation.
Will ICA install equipment or certify the systems?
The typical outputs are a control gap report, coverage observations and operational improvement priorities. Installation and intrusive system testing are outside the base scope. This assessment does not provide certified engineering or a code-compliance determination.
Set priorities for the protections you already have
Discuss a scoped review of the visitor practices, access controls and protective systems causing concern. A defined coverage boundary and documented findings give facilities, security and IT owners a common basis for deciding which operating improvements and further specialist work deserve attention.