The Styx Security ISO 27001 “Say It Like You Mean It!” Physical Security Toolkit is now available to all!

This guide uses the adversarial approach to physical security to help expose the gaps that you don’t see, but the criminals do. Those gaps are your risks.

The toolkit isn’t meant to hold your hand (it’s definitely not a guide to implementing the standard), but it’s meant to give experienced consultants a different perspective on identifying risks.

The guide is a resource to help plug some of the gaps that we see routinely. Or, at least, make people aware of the risks. Whilst the guide is condensed down to brief questions, it is accompanied by a free training course which gives context and answers why we’re asking these questions.

Whilst the toolkit is aimed mainly at experienced ISO 27001 consultants, it’s useable by anyone looking to implement the standard or take an adversarial look at their physical security.

Thanks to Gary Hibberd of Consultants Like Us for taking the time to review the guide and provide invaluable feedback.

We ask different questions:

Click thumbnails to read full sized samples.

When you installed CCTV, did you install a security or surveillance system?

How do you differentiate between an upset employee who didn’t get a promotion and a real insider threat?

Do you have building plans on display for the fire brigade? Do they have “server room” marked on it? Does this help criminals?

Are you keeping up to date on new risks? Are people bringing ebikes inside to charge them? Should they?

Is your paper confidential waste treated the same as sensitive, digital data stored in plain text? Is it in marked bags for easy identification? How does this help a criminal?

Free Online Training Course

There is also a free course on Only Security which covers the same points as the toolkit but gives context, detail and examples as to why we’re asking these specific questions.

Depending on your reading speed, this will take a couple of hours to complete, furnish you with the rationale underpinning the adversarial approach and provide a certificate at the end for CPD. The course covers security concepts from an angle most people never consider, including psychology of insider threats and when and why to advertise or hide security features.

This course is free, requiring just an Only Security account.