Partner-coordinated physical security assessment
Physical security adversarial assessment to guide control improvements
Validate selected physical-security controls against agreed objectives through authorized, specialist partner-led testing. ICA coordinates a scoped engagement that connects partner findings with an executive briefing and remediation priorities, subject to partner delivery approval.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Validate the controls your organization relies on
A facility walkthrough can identify weaknesses in site conditions and protective measures. Corporate security leaders sometimes need a further step: controlled testing of whether selected controls work against a defined objective.
This engagement is intended for corporate security, facilities, CISO and enterprise risk teams seeking that validation. It helps you decide which observed weaknesses deserve attention and where protective measures need improvement. The objective should reflect a business concern, such as confidence in a particular access boundary, rather than a broad challenge to defeat every safeguard.
Choose the physical controls and objectives to test
Coverage centers on selected physical-security controls, not an unrestricted review of every location. Scoping identifies the sites and areas involved, the protective measures to evaluate, and what evidence would answer the agreed objective. Candidate controls may include an approved access boundary or visitor-control process; the specialist partner must confirm the proposed coverage.
Shared premises, tenant responsibilities and sensitive areas can change what is appropriate to test. The authorized scope must distinguish client-controlled areas from spaces owned or operated by others. Any activity beyond that boundary needs its own approval before it becomes part of the engagement.
Use specialist-led testing under written authorization
ICA’s role is to coordinate the engagement. Physical testing is specialist partner-led only, with delivery subject to approval. The authorized test plan establishes the objectives and permitted activities before testing begins. Written authorization, safety controls and agreed boundaries are prerequisites for any covert testing.
Rules of engagement define how the work can proceed and when it must stop. Scoping also addresses insurance and legal review. Preparation may include relevant control documentation and discussions with the people responsible for the selected safeguards. These materials provide context; the partner’s testing produces the findings against the agreed objectives. The specific method and evidence requirements must be confirmed with the partner.
Connect partner findings to remediation decisions
The catalog identifies four typical outputs. Their detail and format are established in the engagement scope:
Authorized test plan. The agreed basis for testing, including objectives and boundaries. Client owners use it to understand and approve what the specialist partner will evaluate.
Partner findings. A record of observations from the authorized work. Security and facilities teams use the findings to understand weaknesses in the selected controls and the limits of what was tested.
Executive briefing. A leadership-level explanation of the findings. It connects the tested objectives with the decisions executives need to make about physical-security improvements.
Remediation priorities. Recommended areas for attention. Delivery owners use them to plan corrective work and discuss responsibility for the affected controls.
These outputs support decisions within the tested scope. They should not be read as proof that every physical threat has been identified.
Prepare the people, permissions and operating context
Begin scoping with the control you want to validate and why it matters. Identify the site owner, the people who can authorize testing, and the security or facilities contacts who understand operating constraints. Relevant preparation may include site boundaries, control procedures and known restrictions on activity.
Cost and timing depend on the proposed objectives, location coverage and permitted testing depth. Partner resources, authorization arrangements, insurance and legal review also affect feasibility. Agree safety arrangements, communication responsibilities and stop conditions before active work. The engagement should proceed only when partner delivery and the complete testing scope have been approved.
Keep validation separate from broader security work
An advisory facility assessment examines conditions and recommends improvements. This offer adds controlled validation of selected controls through a specialist partner. A review of access, visitor and protective systems may be the better starting point when the underlying processes need to be understood before testing.
Covert testing requires written authorization, safety controls and agreed boundaries. Guard services and operational protection are outside this assessment. Installation, remediation execution and follow-up testing require separate agreement. Technical penetration testing is also a separate scope; permission to evaluate a physical control does not authorize testing a network or application.
Questions about partner-coordinated physical testing
Who is this assessment for?
Corporate security, facilities, CISO and enterprise risk teams that need controlled validation beyond an advisory walkthrough.
Can it cover multiple facilities?
Proposed locations can be considered during scoping. Each facility needs defined boundaries and appropriate authorization. Coverage depends on partner approval and the operating constraints at each site; it is not automatically enterprise-wide.
How are the testing method and evidence agreed?
The specialist partner confirms the method against the selected objectives. The authorized test plan and rules of engagement establish permitted activities, evidence requirements and safety limits before testing starts.
What affects cost and timing?
Objectives, sites and testing depth shape the work. Partner resources and the time needed to establish authorization, insurance and legal review also matter. Price and timing require an agreed scope.
How does this differ from a facility assessment?
A facility assessment reviews conditions and protective measures. This partner-coordinated engagement tests selected controls against agreed objectives. An advisory review can help clarify which controls warrant later validation.
Does the engagement include fixing or retesting findings?
The typical outputs are an authorized test plan, partner findings, an executive briefing and remediation priorities. Corrective work and retesting are separately agreed. Your organization decides how to act on the recommendations.
Define the physical control decision you need to make
Bring a clear validation objective to the scope discussion. Establish the boundaries and partner requirements before committing to active testing. A focused, authorized engagement can give leadership evidence for deciding which physical-security improvements to prioritize.
Validate the controls your organization relies on
A facility walkthrough can identify weaknesses in site conditions and protective measures. Corporate security leaders sometimes need a further step: controlled testing of whether selected controls work against a defined objective.
This engagement is intended for corporate security, facilities, CISO and enterprise risk teams seeking that validation. It helps you decide which observed weaknesses deserve attention and where protective measures need improvement. The objective should reflect a business concern, such as confidence in a particular access boundary, rather than a broad challenge to defeat every safeguard.
Choose the physical controls and objectives to test
Coverage centers on selected physical-security controls, not an unrestricted review of every location. Scoping identifies the sites and areas involved, the protective measures to evaluate, and what evidence would answer the agreed objective. Candidate controls may include an approved access boundary or visitor-control process; the specialist partner must confirm the proposed coverage.
Shared premises, tenant responsibilities and sensitive areas can change what is appropriate to test. The authorized scope must distinguish client-controlled areas from spaces owned or operated by others. Any activity beyond that boundary needs its own approval before it becomes part of the engagement.
Use specialist-led testing under written authorization
ICA’s role is to coordinate the engagement. Physical testing is specialist partner-led only, with delivery subject to approval. The authorized test plan establishes the objectives and permitted activities before testing begins. Written authorization, safety controls and agreed boundaries are prerequisites for any covert testing.
Rules of engagement define how the work can proceed and when it must stop. Scoping also addresses insurance and legal review. Preparation may include relevant control documentation and discussions with the people responsible for the selected safeguards. These materials provide context; the partner’s testing produces the findings against the agreed objectives. The specific method and evidence requirements must be confirmed with the partner.
Connect partner findings to remediation decisions
The catalog identifies four typical outputs. Their detail and format are established in the engagement scope:
Authorized test plan. The agreed basis for testing, including objectives and boundaries. Client owners use it to understand and approve what the specialist partner will evaluate.
Partner findings. A record of observations from the authorized work. Security and facilities teams use the findings to understand weaknesses in the selected controls and the limits of what was tested.
Executive briefing. A leadership-level explanation of the findings. It connects the tested objectives with the decisions executives need to make about physical-security improvements.
Remediation priorities. Recommended areas for attention. Delivery owners use them to plan corrective work and discuss responsibility for the affected controls.
These outputs support decisions within the tested scope. They should not be read as proof that every physical threat has been identified.
Prepare the people, permissions and operating context
Begin scoping with the control you want to validate and why it matters. Identify the site owner, the people who can authorize testing, and the security or facilities contacts who understand operating constraints. Relevant preparation may include site boundaries, control procedures and known restrictions on activity.
Cost and timing depend on the proposed objectives, location coverage and permitted testing depth. Partner resources, authorization arrangements, insurance and legal review also affect feasibility. Agree safety arrangements, communication responsibilities and stop conditions before active work. The engagement should proceed only when partner delivery and the complete testing scope have been approved.
Keep validation separate from broader security work
An advisory facility assessment examines conditions and recommends improvements. This offer adds controlled validation of selected controls through a specialist partner. A review of access, visitor and protective systems may be the better starting point when the underlying processes need to be understood before testing.
Covert testing requires written authorization, safety controls and agreed boundaries. Guard services and operational protection are outside this assessment. Installation, remediation execution and follow-up testing require separate agreement. Technical penetration testing is also a separate scope; permission to evaluate a physical control does not authorize testing a network or application.
Questions about partner-coordinated physical testing
Who is this assessment for?
Corporate security, facilities, CISO and enterprise risk teams that need controlled validation beyond an advisory walkthrough.
Can it cover multiple facilities?
Proposed locations can be considered during scoping. Each facility needs defined boundaries and appropriate authorization. Coverage depends on partner approval and the operating constraints at each site; it is not automatically enterprise-wide.
How are the testing method and evidence agreed?
The specialist partner confirms the method against the selected objectives. The authorized test plan and rules of engagement establish permitted activities, evidence requirements and safety limits before testing starts.
What affects cost and timing?
Objectives, sites and testing depth shape the work. Partner resources and the time needed to establish authorization, insurance and legal review also matter. Price and timing require an agreed scope.
How does this differ from a facility assessment?
A facility assessment reviews conditions and protective measures. This partner-coordinated engagement tests selected controls against agreed objectives. An advisory review can help clarify which controls warrant later validation.
Does the engagement include fixing or retesting findings?
The typical outputs are an authorized test plan, partner findings, an executive briefing and remediation priorities. Corrective work and retesting are separately agreed. Your organization decides how to act on the recommendations.
Define the physical control decision you need to make
Bring a clear validation objective to the scope discussion. Establish the boundaries and partner requirements before committing to active testing. A focused, authorized engagement can give leadership evidence for deciding which physical-security improvements to prioritize.