# Physical Security Breach Playbook
A Physical Security Breach Playbook is a structured, pre-authorized set of response procedures that guides security teams through detection, containment, investigation, recovery, and post-incident activities when an unauthorized individual gains or attempts to gain physical access to a controlled environment. It exists because improvised responses to physical intrusions consistently produce incomplete evidence trails, delayed stakeholder notifications, and missed reentry opportunities for threat actors. The playbook solves the coordination problem: when an alarm trips or a guard reports a tailgating incident, every responder needs to know exactly what to do, in what order, and who owns each decision. Without that structure, response degrades into competing priorities and lost time.
A Physical Security Breach Playbook is a formalized incident response document that specifies the roles, timelines, decision criteria, and procedural steps required to manage an unauthorized physical access event from initial detection through post-incident closure. It sits within the broader Security Incident Response Program (SIRP) and is specifically scoped to threats that involve human presence in restricted physical space rather than purely digital intrusion.
This playbook covers events including unauthorized entry to data centers, server rooms, executive floors, manufacturing floors with sensitive equipment, and any controlled area where physical presence creates risk to assets, data, or personnel. It also covers adjacent events such as theft of physical media, tampering with hardware, installation of rogue devices (keyloggers, network taps), and coercion of authorized personnel.
The playbook is NOT a general access control policy, a facility management procedure, or a guard scheduling document. It does not govern routine badging failures, lost credentials, or building maintenance access. Those are operational access management processes, not incident response.
Subtypes within scope include: tailgating incidents (an unauthorized person follows an authorized person through a secured door); forced entry events (a door, lock, or barrier is physically defeated); insider-assisted intrusion (an authorized employee grants access to an unauthorized person); and device implant incidents (a threat actor enters, installs a rogue device, and exits without being detected until later forensic discovery). Each subtype carries different investigation priorities and containment logic, but all flow through the same playbook framework with branching decision points based on severity and category.
The Physical Security Breach Playbook operates as a phased response framework with time-boxed actions at each stage.
Phase 1: Detection and Initial Triage (0 to 15 Minutes)
Detection triggers include: automated alerts from access control systems (door held open, badge read followed by no egress read, motion sensor activation in restricted zones after hours); video analytics flagging unrecognized individuals; guard reports of suspicious behavior; employee reports of tailgating; and threat intelligence indicating a target organization may be under physical reconnaissance.
Upon trigger, the on-call security analyst or physical security officer acknowledges the alert and begins triage. The first question is whether the event is confirmed or suspected. A confirmed breach means video or guard observation has positively identified an unauthorized individual inside a restricted space. A suspected breach means an anomalous signal (door held open, unexpected badge use) has not yet been corroborated visually.
Triage produces a severity rating. Severity 1 is an active intrusion with an individual currently inside a restricted zone. Severity 2 is a confirmed completed intrusion where the individual has exited but access was confirmed. Severity 3 is a suspected event under investigation. Severity determines the notification chain and containment pace.
Phase 2: Containment (15 to 60 Minutes)
Containment actions depend on severity. For Severity 1, the immediate action is to lock down the affected zone using remote door control if available, dispatch physical security to the location, and notify law enforcement if the zone contains critical infrastructure or sensitive data. Personnel in the zone receive a shelter-in-place instruction via the facility communication system. For Severity 2, containment focuses on securing the compromised entry point, pulling video footage, and initiating a sweep of the affected area to identify any planted devices or disturbed equipment.
Evidence preservation begins simultaneously with containment. This means: do not reboot or power off any system that an intruder may have touched; do not clean up any disturbed materials; photograph the scene before any remediation; and preserve access control logs in a read-only copy immediately, because some systems overwrite logs on a rolling basis.
The containment phase must also address network isolation for any compromised zone. If the intrusion affects a data center or server room, the network team receives immediate notification to monitor for anomalous traffic and prepare for potential device quarantine. Physical access often precedes lateral movement in the digital environment, and network controls become the secondary containment layer.
Phase 3: Investigation (1 to 72 Hours)
Investigation follows a structured sequence. Video review reconstructs the intrusion timeline: when did the individual enter, what did they do, and when did they exit. Access control logs confirm badge events and correlate with video timestamps. Physical inspection inventories all equipment in the affected area, comparing serial numbers against asset management records to identify missing or added hardware.
If a rogue device is discovered (a hardware keylogger plugged into a workstation, a network tap installed on a switch port, a Raspberry Pi hidden behind a server), the incident immediately escalates to the cybersecurity incident response team. The device is photographed in place, then removed using forensic chain-of-custody procedures. Network traffic is analyzed from the time window of the suspected implant forward.
Personnel interviews are a critical investigation component often overlooked in technical security programs. The playbook must define who interviews which personnel and what questions get asked. Anyone with legitimate access to the affected zone during the intrusion window gets interviewed about what they observed, whether they saw anyone unfamiliar, and whether they noticed any equipment changes. Cleaning staff, maintenance contractors, and night shift workers are frequently the best sources of ground-truth information about physical anomalies.
A concrete scenario illustrates the investigation workflow: a facilities contractor is granted escorted access to a data center to replace a cooling unit. The escort leaves the contractor briefly unattended near a row of servers. Three weeks later, a network monitoring tool flags unusual outbound traffic from a server in that row. Investigation reveals a small network implant installed on the switch serving that row, consistent with the contractor's unattended window. The Physical Security Breach Playbook governs both the original access event (which should have triggered an escort compliance check) and the retrospective investigation linking the physical access to the network compromise.
The investigation must also determine method of entry. Did the intruder use social engineering to convince an employee to grant access? Did they wait near a door for someone to tailgate? Did they defeat the locking mechanism directly? Did they have inside assistance? Each method points to different control failures and different remediation requirements.
Phase 4: Recovery (24 to 96 Hours)
Recovery involves replacing or re-imaging any system confirmed or suspected to have been tampered with. Rekeying or reprogramming electronic locks on affected entry points is standard. Access credentials for any individual whose badge was used anomalously are revoked and reissued. Enhanced monitoring is deployed on the affected zone: increased video retention, additional motion sensors, and more frequent guard patrols.
Return-to-normal-operations criteria require: confirmation that no rogue devices remain in the affected zone, completion of the asset inventory reconciliation, sign-off from the incident commander that the root cause is understood and addressed, and approval from the CISO or physical security director.
Recovery must address both immediate technical remediation and process changes. If the breach exploited a policy gap (insufficient escort procedures, inadequate visitor identification requirements), the policy gets updated immediately and all affected personnel receive training before normal operations resume. This prevents the same attack vector from succeeding again during the window between incident closure and the next policy review cycle.
Phase 5: Post-Incident (Within 30 Days)
A formal lessons-learned session produces documented findings covering detection gaps, response timeline gaps, and control failures. The playbook is updated based on findings. New detection rules are written into the access control and video analytics systems. If a control gap enabled the breach (no escort policy, no camera coverage at a specific entry point), a remediation ticket is opened with a defined owner and completion date.
The post-incident phase must also address employee communication. Physical breaches generate rumors and speculation among staff, particularly if law enforcement was involved or if work areas were cordoned off during investigation. The playbook should include template communications for employees explaining what happened, what changes are being made, and what employees should watch for going forward.
Physical security breaches create direct pathways to consequences that purely digital defenses cannot prevent. A threat actor who achieves physical access to a server room can install a hardware implant that bypasses every network-based security control: endpoint detection, firewalls, SIEM alerting, none of it catches a device that sits between the network cable and the switch port. Without a playbook, organizations discover this weeks or months later during an unrelated investigation, and the entire intervening period represents uncontrolled exposure.
The business impact of unmanaged physical breaches extends beyond the immediate technical compromise. Regulatory frameworks including PCI DSS, HIPAA, and SOC 2 require documented procedures for physical access incidents. Failure to demonstrate a structured response during an audit produces findings that affect certification status and customer trust. SOC 2 Type II reports specifically examine whether the organization followed its documented procedures during any physical security incidents in the report period.
Physical breaches also expose organizations to significant financial liability. If an intruder steals customer data by physically accessing systems, notification requirements and breach response costs apply just as they would for a network intrusion. But physical breaches often go undetected longer than digital attacks, meaning the exposure window and potential data volume are larger. The average cost of a data breach in 2023 was $4.45 million globally, and physical theft incidents consistently rank among the highest cost per record compromised.
The consequences of operating without a playbook are well-documented. In 2023, a series of physical intrusion incidents targeting financial sector firms in the United States involved threat actors who posed as IT contractors, gained physical access to branch locations, and installed network taps. Firms with mature physical incident response programs detected and removed the devices within days. Firms without structured playbooks were notified by law enforcement weeks after the initial intrusion, by which time significant data had transited the implanted devices.
A common misconception is that physical security is a facilities management problem separate from cybersecurity incident response. This separation produces exactly the coordination failure that threat actors depend on: the guard who sees something unusual files a paper report that never reaches the SOC, and the SOC analyst who sees unusual network traffic never checks whether a physical access event preceded it. The playbook eliminates that gap by creating a unified response chain that spans both domains.
A second misconception is that physical breaches are rare compared to digital attacks. The Verizon Data Breach Investigations Report consistently shows that physical attacks, including social engineering for physical access, skimming, tampering, and theft, account for meaningful percentages of incidents across industries, particularly retail, healthcare, and financial services. Organizations that dismiss physical security as a low-probability threat are often the same ones that discover hardware implants during routine maintenance months after installation.
CDA addresses physical security breach response within the Sovereignty and Physical Hardening (SPH) domain of the Planetary Defense Model. SPH governs the hardening of physical environments, the integrity of hardware and facilities, and the response procedures required when physical controls are defeated or circumvented.
The Autonomous Posture Command (APC) methodology, operating under the principle "Your posture adapts. Your hygiene never sleeps," drives CDA's approach to physical breach response. Rather than treating the playbook as a static document reviewed annually, APC treats it as a living posture artifact that updates automatically based on threat intelligence, post-incident findings, and control assessment outputs. When a physical breach occurs, the APC framework triggers not only the response workflow but also an immediate posture reassessment: which other zones share the same control profile as the breached zone, and do they need enhanced monitoring now, before a breach occurs there.
Operationally, CDA's Physical Security Breach Playbook integrates access control telemetry, video analytics outputs, and physical asset inventory data into a single investigation workspace. When a breach is declared, the system automatically pulls the last 72 hours of access control logs for the affected zone, flags any badge events involving contractors or visitors, and cross-references those events against the cybersecurity event log to identify any network anomalies that correlate temporally with physical access. This cross-domain correlation is where CDA differentiates from conventional physical security programs that treat the guard desk and the SOC as separate functions.
CDA's playbook templates are tiered by zone sensitivity. A breach in a general office area follows a lighter-weight response path. A breach in a Tier 1 data center triggers the full playbook including law enforcement notification criteria, forensic device handling procedures, and executive communication templates. Zone sensitivity is defined in the SPH asset register and updated as part of quarterly posture reviews.