PHYSICAL SECURITY ASSESSMENT DOCUMENTATION

This repository is TrustedSec language used for when conducting physical penetration tests. This wording was created utilizing a third party law firm on behalf of TrustedSec to apply as much protections around conducting physical security assessments due to the Iowa arrests regarding Coalfire. Our goal with releasing this documentation is to hopefully help others that conduct physical security assessments and help them structure the engagements in a way that protects them as much as possible.

We are releasing this as is, and it is up to you to ensure that you are adequately protected. TrustedSec does not place a guarantee on any of the information and is provided to be used as a template that can be used with other organizations.

The three documents are not joined together, if you only have a statement of work – adding the SOW verbiage is fine. For master service agreements, there is the MSA section. The authorization form should be created with your letterhead and the companies and make it look professional looking. We recommend only having an officer of the company sign and a notary to validate that the person that is signing the document is the actual person giving authorization to conduct the assessments.

Some words of advice, while it is on the customer to authorize you to conduct a physical penetration test, there are some things to consider:

• Ensure that the authorizing party owns the facility that you are conducting the assessment on. If it is a shared building, you will need to ensure that the customer contacts and notifies the building owner and also signs authorization to conduct the work.
• An officer of the company should sign the document as they typically have authority to conduct such testing. Directors and people within IT and the security department might not always have the authorization to conduct physical security tests.
• When conducting a physical penetration test, if there are hour windows to conduct them, ensure that you stay within the confines of these hours.
• Clearly outline the scope of what is acceptable and what is not, for example – lockpicking, physical damage, social engineering, and more.
• Discuss with the customer what a typical physical penetration test is and explain the scenarios and situations.
• Consider notifying law enforcement ahead of time if acceptable by the customer.
• Ensure that the contact information on the authorization letter is correct and check them before actually conducting the assessment.

Our intent with this release to help other companies and organizations provide language around conducting physical security assessments. We have added a LICENSE file which essentially grants full usage, modification, selling, or anything else to you without any tie to TrustedSec. This means use this to help your organization anyway you can, and can be used for whatever purpose you see fit. This documentation comes without a warranty or guarantee in any fashion.

More information here:
https://www.trustedsec.com/blog/a-message-of-support-coalfire-consultants-charged/

How to Get Physical Security Assessment Documentation

Option 1
Download the Physical Authorization Letter
https://github.com/trustedsec/physical-docs/blob/master/PhysicalAuthorizationLetter_v1.txt

Option 2
View on Git.

How to Get Help with Physical Security Assessment Documentation
For bug reports or enhancements, please open an issue on this projects GitHub page.