Conduct an annual physical penetration test of your offices and data centre

Organisations that conduct regular network penetration tests often have no equivalent programme for physical security. Physical penetration testing — engaging a firm to attempt tailgating, impersonation, dumpster diving, and device planting at your facilities — reveals gaps that policy and awareness training cannot surface. Professional physical pentesters routinely succeed in entering secure areas, planting rogue network devices, and photographing sensitive materials. The results directly inform where physical controls need investment. At minimum, conduct an annual physical security assessment of your primary office, data centre, and any facility that houses network equipment.