What is a physical security policy and what should it cover?

• A. A formal document outlining rules for access control, incident reporting, visitor handling, and safety.
• B. A casual memo about security awareness.
• C. A budget plan for security equipment.
• D. A set of legal regulations with no procedures.

Answer: (A)

A physical security policy is a formal, internal document that turns security goals into concrete rules and procedures for protecting people and property from physical threats. It provides the framework that guides everyday actions and decisions, ensuring consistency and accountability across the organization.

A good physical security policy covers how access to facilities is controlled, including who can enter, how they prove who they are, what credentials are required, and how entry points are secured. It describes how incidents or security events are reported, escalated, investigated, and documented, so there’s a clear, repeatable process. Visitor handling is defined—how visitors are registered, escorted, issued temporary badges, and tracked while on site. It also outlines safety and emergency procedures, such as evacuation routes, assembly points, shelter-in-place guidelines, and coordination with local responders.

Beyond people, the policy addresses protection of assets and information in physical form—control of keys and access devices, securing equipment, and appropriate use of surveillance systems, all with attention to privacy and legal considerations. It sets expectations for training and awareness, including onboarding and ongoing security drills. Roles and responsibilities are specified so who does what is clear, along with how compliance is enforced, how exceptions are approved, and how the policy is reviewed and updated over time.

The other options don’t fit because they lack the formal, actionable scope: a casual memo isn’t enforceable, a budget plan focuses on costs rather than rules, and a set of laws without procedures doesn’t provide the internal guidance an organization needs to operate securely.