Physical security: checklist and advice
Last updated: · IT-Checklist editorial team · All changes
Think of a laptop stolen from a car, or a printer full of customer data that ends up at the scrapyard. Or a visitor who can sit at an unattended computer for a moment. Physical security is less exciting than hackers. In practice it leads to data breaches just as often.
This topic covers the things themselves: devices, rooms, paper and keys. And what happens when they go missing or leave the business.
Check where your business stands on physical security
The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.
Start the IT check →Why this matters
A lost laptop without disk encryption is a data breach you may have to report under the GDPR. With encryption and a good PIN it is mostly just a cost.
Old computers, phones and copiers often still hold years of business data. If you don't wipe them securely, that data goes along to the next owner.
The 10 questions in this topic, with advice
Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.
Laptops and phones are locked with a PIN, password or biometrics.
ImportantSet automatic locking on all devices (max. 5 minutes) and require a strong PIN or biometrics.
Stolen or lost devices can be wiped remotely.
RecommendedEnable 'Find my device' (Windows/Apple/Android) or use MDM software so you can wipe devices remotely.
Visitors cannot reach workplaces, servers or network equipment unaccompanied.
RecommendedPlace network equipment and servers in a lockable room or cabinet and do not let visitors walk around unaccompanied.
Confidential documents are stored securely and shredded when discarded.
RecommendedUse a lockable cabinet for confidential paperwork and a shredder instead of the waste bin.
Screens with sensitive information are not visible to outsiders and lock automatically.
RecommendedArrange workplaces so screens are not readable from the street or front desk and use automatic screen locking.
Old computers, phones and drives are securely wiped before disposal.
RecommendedFully wipe discarded devices (factory reset + prior encryption) or have them destroyed by a certified party.
Server or network equipment is protected against power failure, overheating and water damage (e.g. UPS, ventilation, not on the floor).
RecommendedPlace equipment in a ventilated space, not on the floor (water damage) and consider a UPS so equipment can shut down cleanly during a power failure.
Keys, access badges and alarm codes are managed and collected or changed when someone leaves.
RecommendedTrack who holds which keys, badges and codes. Collect them on departure and change alarm codes — physical access is as sensitive as digital access.
USB sticks or external drives of unknown origin are never simply plugged into work computers.
RecommendedA 'found' USB stick is a well-known attack method. Agree that unknown media are not plugged in and use a virus scan or a separate computer where possible.
Rooms with valuable equipment are protected against burglary (alarm, cameras or solid locks).
RecommendedCombine solid locks with an alarm or cameras. When equipment is stolen you lose not just the hardware, but possibly also the data on it.
Where to start
- Set a screen lock on every device that kicks in after a few minutes of inactivity.
- Turn on 'Find my device' or mobile device management. Then you can wipe a stolen laptop or phone remotely.
- Agree that old devices only leave once they are securely wiped or destroyed. If you outsource this, ask for a certificate.
- Keep track of who has which keys, cards and alarm codes. Collect them when someone leaves.
Common mistakes
- Putting the server or NAS on the floor of a cupboard with no ventilation or power protection.
- Throwing confidential papers in the ordinary paper bin.
- Plugging in a USB stick you found 'just to see whose it is'.
Official sources
Read next
All topics in the checklist