By Phantom PenTest · Published
1. Decide which questions the assessment should answer
Begin with the decisions the findings will support. You may want to understand whether access permissions match job responsibilities, whether cameras provide useful coverage, or whether procedures work consistently across different shifts.
Explain any planned changes, recurring concerns or recent operational changes that make the review useful now. Separate what is known from what is suspected. A clearly stated concern is more useful than a predetermined conclusion about which equipment needs replacing.
2. Agree on the scope and boundaries
Identify the facilities, areas, operating hours and processes to be reviewed. Record any excluded areas, restrictions on photography, escort requirements and activities that could disrupt operations. For multiple locations, decide which sites need individual attention and which shared processes can be reviewed together.
A physical security assessment and controlled physical penetration testing serve different purposes. A walkthrough or document review does not itself authorize attempted entry, alarm activation or other testing. Where controlled testing is included, agree on written authorization, permitted activities, safety boundaries, stop conditions and escalation contacts before it begins.
3. Identify the right people
Choose a primary coordinator who can arrange access and bring the appropriate stakeholders into the discussion. Depending on the scope, useful participants may include security leadership, facilities, access administration, operations, human resources and people responsible for monitoring or responding to alarms.
Make sure the review includes people who understand everyday conditions. A written visitor procedure and the experience of the people managing visitors can provide different, equally useful perspectives. Agree who receives the final report and who will make decisions about improvements.
4. Gather relevant information securely
The assessor should confirm what is needed for the agreed scope. Useful starting materials may include:
- A current site plan and a list of in-scope buildings, entrances and restricted areas.
- An inventory of access control, surveillance, alarm and related physical security equipment.
- Relevant policies, post orders, visitor procedures and access approval or removal workflows.
- Maintenance records, previous findings and open remediation actions.
- A summary of relevant incidents or recurring operational concerns, with personal information minimized.
Existing information is useful even when it is incomplete. Identify known gaps rather than presenting an inventory as verified when it has not been checked. Agree on secure transfer, access permissions and handling expectations before sharing sensitive records. Do not place credentials, confidential facility layouts or detailed vulnerabilities in a public booking form.
5. Plan around normal operations
Coordinate escorts, interviews and access windows without creating unnecessary disruption. Highlight conditions such as deliveries, shift changes, patient care, student activity or major events that may affect the work.
Describe normal operating practices honestly. Temporarily changing a process solely for an assessment can hide the conditions the organization needs to understand. Address urgent safety concerns when they arise, and explain recent changes so the assessor can distinguish historical issues from current conditions.
6. Define what a useful result looks like
Agree on the reporting format, leadership discussion and level of evidence needed to support decisions. Phantom PenTest's assessment deliverables are designed around an Executive Summary, Leadership Debrief, Risk-Ranked Findings, Evidence & Recommendations, and a Remediation Roadmap.
Identify who will own follow-up actions and how progress will be tracked. A finding is more useful when leadership understands its significance and the next step. Our guide to prioritizing physical security findings explains how exposure, consequences and existing safeguards inform those decisions.
A practical preparation checklist
- Write down the main security questions and decisions the review should support.
- Confirm the locations, activities, exclusions and operating constraints in scope.
- Nominate a coordinator and agree who needs to participate.
- Gather relevant documents and identify information that is missing or out of date.
- Arrange a secure way to share sensitive material.
- Confirm site access, escorts, interviews and escalation contacts.
- Agree on deliverables, report recipients and follow-up responsibilities.
- Document any separately authorized controlled testing and its boundaries.
Common preparation questions
Do we need to replace equipment before an assessment?
An assessment can help determine where improvements are needed. Share known equipment problems and planned changes during scoping. Urgent safety or operational issues should be handled through the organization's established procedures rather than delayed for a review.
What if our documentation is incomplete?
Explain what is available and what is missing. Document review, interviews and observation can help identify where recorded procedures and actual practice differ. The scope should reflect any limits on the evidence available.
How long will the assessment take?
Timing depends on the number and complexity of locations, access arrangements, operating schedules and agreed activities. Define the scope first so the schedule and reporting expectations can be discussed realistically.