Cybersecurity isn't only digital—someone who walks into your building can plug in a malicious device, photograph sensitive documents, or access an unlocked computer directly. This guide covers the physical security fundamentals every small business should have in place: badge systems, escort policies, clean desk habits, and visitor management.
Badge Systems
Individual Accountability
Badge Procedures
- Issue individual badges to every employee—never share badges between people
- Deactivate badges immediately when someone leaves the company or changes roles that no longer require certain access
- Review badge access logs periodically for unusual entry times or repeated failed attempts
- Restrict badge access to only the areas a role actually needs (least privilege applies physically too)
- Require badges to be worn visibly so unauthorized individuals stand out
- Report lost or stolen badges immediately so they can be deactivated
Tailgating Prevention
Tailgating (or "piggybacking") is when an unauthorized person follows an authorized employee through a secured door without badging in themselves—often by simply acting confident or carrying something that makes holding the door seem natural.
Stop It Before It Starts
How to Prevent Tailgating
- Train employees that it's okay—expected—to politely ask an unfamiliar person to badge in themselves
- Don't hold secured doors open for people you don't recognize, even if they seem to be in a hurry or carrying boxes
- Install turnstiles or mantrap doors at high-security entry points where feasible
- Post signage reminding staff that each person must badge in individually
- Report tailgating incidents, even if they turn out to be harmless — this builds awareness of the pattern
Escort Policies
Visitors and Contractors Must Be Escorted
- All visitors, delivery personnel, and contractors sign in and receive a visible visitor badge
- Visitors are escorted at all times in non-public areas—never left unattended near workstations, server rooms, or file storage
- Confirm the visitor's identity and purpose before granting entry, especially for anyone claiming to be "IT support" or "from the building"
- Log entry and exit times for all visitors and contractors
- Notify security or the front desk in advance of expected visitors so unexpected ones are more easily identified
Clean Desk Practices
End-of-Day Clean Desk Checklist
Sensitive Area Access
Extra Controls for High-Risk Areas
- Server rooms, network closets, and file storage areas require separate, restricted badge access beyond general building entry
- Maintain a log of everyone who enters sensitive areas, including employees
- Never prop open doors to secured areas, even temporarily
- Limit the number of people with access to critical infrastructure to those who truly need it
- Consider video monitoring for entry points to server rooms and data storage areas
Visitor Management
Visitor Access Checklist
Incident Reporting
What to Report and How
- Unrecognized individuals in restricted or secure areas
- Tailgating attempts, successful or not
- Lost or stolen badges, keys, or access devices
- Propped-open secure doors or disabled access controls
- Suspicious USB devices or unfamiliar hardware found on-site
- Report to your security team or facilities manager immediately— don't wait until the next scheduled meeting
Real-World Scenario
The "Delivery Driver" Who Wasn't
A person wearing a delivery uniform and carrying a box approaches a secured door as an employee badges in. They ask the employee to hold the door since their hands are full. The employee holds the door without verifying the person's identity or asking them to sign in at the front desk.
What Should Have Happened:
- Politely direct the person to the front desk or main entrance to sign in, regardless of how legitimate they appear
- Offer to carry the package to the front desk rather than letting them follow through the secure door
- Notify security or facilities if the person becomes insistent or leaves before signing in
- Remember: legitimate delivery personnel expect to sign in—it's a normal part of their job, not an inconvenience
Physical Security Best Practices for SMBs
Small businesses often assume physical security is only for large corporations with dedicated security staff. In reality, SMBs are frequent targets precisely because physical controls are often weaker. Build these habits into your culture:
- Make verification normal, not awkward: Train staff that asking "can I see your badge?" is expected, not rude
- Combine physical and digital security training: Include physical security scenarios in your regular security awareness sessions
- Review access logs regularly: Even a small office benefits from periodic review of who accessed what and when
- Plan for offboarding: Physical access should be revoked the same day as digital access when someone leaves