Skip to main content Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Hack23/homepage --skill physical-securityThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name Physical Security description Home office security controls, equipment protection, and environmental security for remote operations license Apache-2.0 version 1.0 author Hack23 AB tags ["physical-security","home-office","equipment-protection","environmental-security","clean-desk-policy"] category security frameworks ["ISO 27001:2022","NIST CSF 2.0","CIS Controls v8.1"] related_policies ["Physical_Security_Policy.md","Asset_Register.md","Information_Security_Policy.md"]
🏠 Physical Security Skill
🎯 Purpose
This skill enforces physical security controls for home office environments, equipment protection, and environmental security. Based on Hack23 AB's Physical Security Policy , it demonstrates how enterprise-grade physical security is achievable for remote-first operations.
Key Principle: Physical security isn't just locks and guards—it's layered protection for remote work environments where traditional perimeter security doesn't exist.
📚 Scope
This skill covers:
🏠 Home Office Security: Workspace protection, access control, secure storage💻 Equipment Protection: Laptops, monitors, mobile devices, storage media👥 Visitor Management: Guest access controls for home office environment🌡️ Environmental Security: Fire, water, temperature, humidity protection🧹 Clean Desk/Screen Policy: Information exposure prevention🔒 Physical Access Controls: Device locks, secure storage, theft prevention
⚙️ Security Rules
MUST Requirements
Physical security controls you MUST implement:
🏠 Workspace Security
home_office_requirements:
dedicated_workspace: required
lockable_door: recommended
window_security: blinds_or_curtains_required
visitor_visibility: minimize_screen_visibility
secure_storage: lockable_cabinet_or_drawer
backup_media: fireproof_safe_or_offsite_storage
💻 Equipment Protection
device_security:
laptops:
- physical_lock_cable: when_in_public_spaces
-
full_disk_encryption:
mandatory
-
screen_privacy_filter:
recommended_for_sensitive_work
-
automatic_screen_lock:
5_minutes_idle_maximum
-
boot_password:
BIOS/UEFI_password_required
mobile_devices:
-
screen_lock:
biometric_or_strong_PIN
-
device_encryption:
mandatory
-
remote_wipe_capability:
enrolled_in_MDM
-
physical_protection:
use_protective_case
storage_media:
-
encryption:
all_removable_media_encrypted
-
labeling:
classification_labels_applied
-
secure_storage:
locked_cabinet_when_not_in_use
-
disposal:
secure_wipe_or_physical_destruction
🌡️ Environmental Controls
environmental_protection:
fire_safety:
- smoke_detectors: installed_and_tested_monthly
- fire_extinguisher: accessible_and_inspected
- evacuation_plan: documented_and_practiced
- electrical_safety: no_overloaded_circuits
water_damage:
- equipment_placement: elevated_off_floor
- leak_detection: water_sensors_near_equipment
- backup_protection: waterproof_bags_for_critical_items
climate_control:
- temperature_range: 15 -25 °C_optimal
- humidity_control: 30 -60 %_relative_humidity
- ventilation: adequate_airflow_for_equipment
🧹 Clean Desk/Screen Policy
information_protection:
end_of_day:
- lock_sensitive_documents: secure_cabinet_or_safe
- secure_removable_media: encrypted_and_locked_away
- log_out_of_systems: all_sessions_terminated
- screen_lock: automatic_lock_enabled
- shred_confidential_waste: cross_cut_shredder
during_work:
- minimize_paper: digital_first_approach
- classify_documents: apply_classification_labels
- visitor_awareness: hide_sensitive_information
- screen_positioning: away_from_windows_and_visitors
👥 Visitor Management
home_office_visitors:
before_visit:
- schedule_visitors: avoid_overlap_with_sensitive_work
- prepare_workspace: secure_all_confidential_materials
- screen_positioning: ensure_no_visibility_of_work
during_visit:
- lock_screens: all_devices_locked
- escort_required: visitor_never_left_alone_in_workspace
- conversation_awareness: avoid_discussing_confidential_matters
after_visit:
- verify_security: check_all_devices_and_documents_secure
- access_review: review_system_access_logs_if_visitor_near_devices
MUST NOT Prohibitions Physical security practices you MUST NOT do:
❌ Equipment Exposure
prohibited_practices:
- leave_devices_unlocked: in_public_or_shared_spaces
- work_in_public: with_sensitive_data_visible_to_others
- store_devices_visibly: in_vehicles_or_unsecured_locations
- share_workspace: with_unauthorized_individuals_during_sensitive_work
- leave_doors_unlocked: when_workspace_contains_business_equipment
❌ Information Exposure
prohibited_behaviors:
- print_unnecessary_documents: use_digital_workflows_instead
- leave_documents_unattended: always_secure_or_destroy
- discuss_confidential_matters: in_public_or_with_visitors_present
- dispose_unsecurely: regular_trash_for_sensitive_documents
- store_passwords_physically: written_passwords_in_visible_locations
❌ Unsafe Practices
dangerous_behaviors:
- overload_circuits: multiple_high_power_devices_on_one_outlet
- block_exits: equipment_blocking_emergency_egress
- ignore_alarms: smoke_detector_or_security_system_alerts
- disable_protection: removing_security_cables_or_locks
- unsecured_backup_media: leaving_backup_drives_visible_or_unlocked
💡 Examples
Example 1: Home Office Setup (Compliant) Scenario: Setting up a secure home office workspace for cybersecurity consulting work.
workspace_security:
location:
room: dedicated_home_office
door: lockable_from_inside
windows:
- privacy_film_applied: true
- blinds_installed: true
- desk_positioned: perpendicular_to_window
equipment:
primary_workstation:
device: Ubuntu_22.04_LTS_laptop
security:
- full_disk_encryption: LUKS_enabled
- BIOS_password: configured
- physical_lock_cable: attached_to_desk
- screen_privacy_filter: installed
monitors:
count: 2
positioning: facing_away_from_door_and_windows
privacy: screen_not_visible_from_hallway
mobile_devices:
- iPhone_with_MDM: biometric_lock_enabled
- iPad: encrypted_and_screen_locked
storage:
secure_cabinet:
type: lockable_metal_filing_cabinet
contents:
- backup_drives: encrypted_USB_drives
- client_contracts: physical_copies_locked
- hardware_tokens: YubiKeys_secured
fireproof_safe:
contents:
- critical_backups: offline_encrypted_backups
- emergency_contacts: printed_emergency_procedures
environmental:
fire_protection:
- smoke_detectors: 2_units_tested_monthly
- fire_extinguisher: ABC_rated_inspected_annually
climate_control:
- temperature: thermostat_set_20°C
- humidity: dehumidifier_maintains_45%_RH
power_protection:
- UPS: 1500VA_battery_backup_for_workstation
- surge_protection: all_devices_on_surge_protectors
clean_desk_policy:
daily_routine:
- end_of_day: all_documents_locked_in_cabinet
- screen_lock: automatic_after_5_minutes
- shredding: cross_cut_shredder_for_sensitive_waste
Result: ✅ Compliant - Comprehensive physical security controls for home office
A.7.4: Physical security monitoring
A.7.9: Security of assets off-premises
A.7.13: Clear desk and clear screen
Example 2: Visitor Access Control (Compliant) Scenario: Client visiting home office for project kick-off meeting.
visitor_access_control:
pre_visit_preparation:
schedule:
date: 2026-02-15
time: 10 :00-12:00
visitor: client_representative
security_actions:
- review_calendar: no_overlapping_sensitive_work
- secure_materials:
- lock_client_contracts: all_other_clients_secured
- close_applications: client_systems_logged_out
- position_screens: face_away_from_guest_seating
- prepare_meeting_area:
- clean_desk: no_documents_visible
- lock_cabinets: filing_cabinet_secured
- test_screen_lock: automatic_lock_verified
during_visit:
physical_controls:
- workspace_access: visitor_not_allowed_in_office_area
- meeting_location: living_room_separate_from_workspace
- screen_status: all_devices_locked_before_meeting
- door_closed: office_door_closed_and_locked
behavioral_controls:
- conversation_topics: project_scope_only_no_other_clients
- document_handling: only_visitor_specific_materials_shown
- device_access: visitor_devices_not_connected_to_network
- escort_policy: visitor_escorted_if_bathroom_access_needed
post_visit:
verification_checklist:
- physical_security:
- devices_still_locked: verified
- documents_secured: filing_cabinet_still_locked
- no_items_left_behind: workspace_checked
- access_review:
- system_logs: no_unauthorized_access_detected
- network_connections: no_unknown_devices_connected
- follow_up:
- meeting_notes: sensitive_details_encrypted
- next_steps: documented_in_project_tracker
Result: ✅ Compliant - Proper visitor management with information protection
A.7.1: Physical security perimeters
A.7.2: Physical entry
A.7.13: Clear desk and clear screen
Example 3: Equipment Loss Prevention (Non-Compliant → Corrected) Scenario: Laptop left unattended in coffee shop while working remotely.
❌ Non-Compliant Practice:
coffee_shop_work:
laptop_security:
- screen_lock: disabled_for_convenience
- physical_security: left_on_table_while_ordering_coffee
- confidential_work: client_contract_visible_on_screen
- location: public_coffee_shop_with_high_traffic
❌ Device left unattended in public space
❌ Screen lock disabled exposing confidential information
❌ No physical security (cable lock) used
❌ Sensitive work performed in public location
remote_work_policy:
location_assessment:
- evaluate_sensitivity: client_contract_work_is_HIGH_classification
- decision: work_from_home_office_only_for_sensitive_tasks
public_space_work:
allowed_activities:
- general_research: non_client_specific_industry_research
- email_review: non_confidential_communications_only
- code_review: public_open_source_projects_only
required_controls:
- screen_privacy_filter: prevents_shoulder_surfing
- VPN_connection: always_enabled_for_business_access
- screen_lock: automatic_after_2_minutes_in_public
- physical_security: laptop_never_left_unattended
- positioning: back_to_wall_screen_not_visible_to_others
prohibited_activities:
- client_contracts: no_confidential_documents_in_public
- sensitive_data: no_HIGH_or_CRITICAL_data_access
- production_systems: no_administrative_access_from_public_wifi
device_protection:
- physical_lock_cable: attached_when_in_public_spaces
- screen_lock: automatic_and_immediate_when_leaving_seat
- backup_awareness: work_saved_to_cloud_before_leaving_home
Result: ✅ Corrected - Appropriate controls for remote work based on data sensitivity
🔴 Critical/High Data: Work from home office only with full security controls
🟡 Medium Data: Public spaces with screen privacy filter and VPN
🟢 Low/Public Data: Public spaces with basic security awareness
🔗 Integration Points
ISMS Policy Integration This skill implements controls from:
Related Security Skills
cryptography - Encryption requirements for devices and storage mediadata-classification - Information sensitivity and handling requirementsmobile-device-management - Mobile device security controlsaccess-control - Authentication and authorization for devices
Compliance Frameworks
A.7.1 - Physical security perimeters (home office boundary definition)A.7.2 - Physical entry (visitor management and access control)A.7.4 - Physical security monitoring (environmental and equipment monitoring)A.7.9 - Security of assets off-premises (remote work equipment protection)A.7.13 - Clear desk and clear screen (information exposure prevention)A.7.14 - Secure disposal or re-use of equipment (secure destruction procedures)
PR.AC-01 - Physical access to assets is managed and protectedPR.DS-01 - Data-at-rest is protected (encrypted storage media)PR.IP-06 - Data is destroyed according to policy (secure disposal)PR.PT-02 - Removable media is protected (encrypted and secured)
1.1 - Establish and maintain detailed enterprise asset inventory (equipment tracking)3.6 - Securely manage enterprise assets and data (physical security controls)10.7 - Use behavior-based anti-malware software (environmental threat detection)12.8 - Define and maintain role-based access control (visitor management)
🎯 Best Practices
Home Office Security Checklist ## Daily Security Routine
**Start of Day:**
- [ ] Verify workspace door is locked
- [ ] Check environmental controls (smoke detector, temperature)
- [ ] Boot devices with BIOS password
- [ ] Verify screen privacy filter is clean and positioned correctly
- [ ] Check UPS battery status
**During Work:**
- [ ] Lock screen when leaving workspace
- [ ] Position screens away from windows and hallways
- [ ] Secure documents immediately after use
- [ ] Shred sensitive waste in cross-cut shredder
- [ ] Escort visitors if they need access to home during work hours
**End of Day:**
- [ ] Log out of all systems
- [ ] Lock all devices with cable locks or in secure storage
- [ ] Secure all documents in lockable cabinet
- [ ] Secure backup media in fireproof safe
- [ ] Verify all windows and doors locked
- [ ] Set alarm system if available
Equipment Protection Matrix Device Type Physical Security Encryption Access Control Backup 💻 Laptop Cable lock + locked office LUKS full disk BIOS password + screen lock Daily to AWS S3 📱 Mobile Physical case + MDM Device encryption Biometric + PIN iCloud/Google backup 💾 USB Drive Locked cabinet BitLocker/LUKS Password protected Not primary storage 🖥️ Desktop Locked office + bolted desk LUKS full disk BIOS password + screen lock Daily to AWS S3 ⌚ Smart Watch Physical security + MDM Device encryption PIN/Biometric Synced to phone
Environmental Monitoring
home_office_monitoring:
fire_detection:
- smoke_detectors: 2_units_interconnected
- heat_detectors: 1_unit_above_equipment
- testing_schedule: monthly_button_test
water_damage:
- water_sensors: under_AC_units_and_near_windows
- leak_detection: near_water_heater_if_adjacent
- alert_method: SMS_notification_to_phone
climate:
- temperature_sensor: smart_thermostat_with_alerts
- humidity_sensor: standalone_hygrometer
- alert_thresholds:
- temperature: below_15°C_or_above_30°C
- humidity: below_25%_or_above_70%
power:
- UPS_monitoring: software_alerts_for_power_events
- surge_protection: LED_indicators_on_surge_protectors
- generator: optional_for_critical_infrastructure
📊 Risk Mitigation
Physical Security Threats Threat Impact Likelihood Risk Level Mitigation Device Theft 🔴 Critical 🟡 Medium 🔴 High Cable locks, locked office, encryption Fire Damage 🔴 Critical 🟢 Low 🟡 Medium Smoke detectors, fire extinguisher, offsite backups Water Damage 🟠 High 🟡 Medium 🟠 High Elevated equipment, water sensors, waterproof bags Visitor Snooping 🟠 High 🟡 Medium 🟠 High Clean desk policy, screen positioning, visitor escort Environmental 🟡 Medium 🟡 Medium 🟡 Medium Climate control, humidity monitoring, UPS Power Loss 🟡 Medium 🟠 High 🟡 Medium UPS backup, surge protection, saved work Shoulder Surfing 🟡 Medium 🟠 High 🟠 High Screen privacy filters, positioning, awareness
Incident Response
Immediately report to CEO (self-reporting for single-person company)
Remote wipe device if MDM capable (see Mobile Device Management Policy )
Change all passwords accessed from device
Report to police if theft suspected
Review access logs for unauthorized activity
Update Asset Register
Ensure personal safety first
Contact emergency services if necessary
Document damage with photos
Recover equipment if safe to do so
Assess data recovery options
Restore from backups per Backup Recovery Policy
File insurance claim if applicable
🔍 Validation & Testing
Physical Security Audit #!/bin/bash
echo "🏠 Hack23 AB - Physical Security Audit"
echo "========================================"
echo ""
echo "📋 Workspace Security Checklist:"
read -p "Is workspace in a lockable room? (yes/no): " lockable_room
read -p "Are windows covered with blinds/film? (yes/no): " window_privacy
read -p "Is secure storage (cabinet/safe) available? (yes/no): " secure_storage
read -p "Are screens positioned away from windows/doors? (yes/no): " screen_position
echo ""
echo "💻 Equipment Protection Checklist:"
read -p "Are laptops using full disk encryption? (yes/no): " disk_encryption
read -p "Are cable locks used for equipment? (yes/no): " cable_locks
read -p "Are mobile devices enrolled in MDM? (yes/no): " mdm_enrolled
read -p "Is automatic screen lock enabled (<5 min)? (yes/no): " screen_lock
echo ""
echo "🌡️ Environmental Controls Checklist:"
read -p "Are smoke detectors installed and tested? (yes/no): " smoke_detectors
read -p "Is fire extinguisher accessible and inspected? (yes/no): " fire_extinguisher
read -p "Is equipment elevated off floor? (yes/no): " elevated_equipment
read -p "Is UPS/surge protection installed? (yes/no): " power_protection
echo ""
echo "🧹 Clean Desk Policy Checklist:"
read -p "Are documents locked at end of day? (yes/no): " documents_secured
read -p "Is cross-cut shredder available? (yes/no): " shredder_available
read -p "Are backup media secured in safe/cabinet? (yes/no): " backup_secured
score=0
total=13
[[ "$lockable_room " == "yes" ]] && ((score++))
[[ "$window_privacy " == "yes" ]] && ((score++))
[[ "$secure_storage " == "yes" ]] && ((score++))
[[ "$screen_position " == "yes" ]] && ((score++))
[[ "$disk_encryption " == "yes" ]] && ((score++))
[[ "$cable_locks " == "yes" ]] && ((score++))
[[ "$mdm_enrolled " == "yes" ]] && ((score++))
[[ "$screen_lock " == "yes" ]] && ((score++))
[[ "$smoke_detectors " == "yes" ]] && ((score++))
[[ "$fire_extinguisher " == "yes" ]] && ((score++))
[[ "$elevated_equipment " == "yes" ]] && ((score++))
[[ "$power_protection " == "yes" ]] && ((score++))
[[ "$documents_secured " == "yes" ]] && ((score++))
[[ "$backup_secured " == "yes" ]] && ((score++))
compliance_percentage=$((score * 100 / total))
echo ""
echo "========================================"
echo "📊 Compliance Score: $score /$total ($compliance_percentage %)"
echo ""
if [ $compliance_percentage -ge 90 ]; then
echo "✅ EXCELLENT - Physical security controls are comprehensive"
elif [ $compliance_percentage -ge 70 ]; then
echo "⚠️ GOOD - Minor improvements needed"
elif [ $compliance_percentage -ge 50 ]; then
echo "⚠️ FAIR - Significant gaps exist, immediate action required"
else
echo "❌ POOR - Critical physical security deficiencies"
fi
echo ""
echo "📝 Document findings in Security Metrics and Asset Register"
echo "🔄 Schedule remediation for any 'no' responses"
Monthly Security Review ## Physical Security Monthly Review Checklist
**Date:** [YYYY-MM-DD]
**Reviewer:** CEO
### Equipment Inventory
- [ ] Verify all devices in Asset Register are accounted for
- [ ] Check encryption status on all laptops and storage media
- [ ] Test screen locks and BIOS passwords
- [ ] Inspect cable locks for damage or tampering
- [ ] Verify mobile device MDM enrollment status
### Environmental Systems
- [ ] Test smoke detectors (button test)
- [ ] Inspect fire extinguisher pressure gauge
- [ ] Check UPS battery status and runtime test
- [ ] Test water sensors if installed
- [ ] Review climate control (temperature/humidity logs)
### Workspace Security
- [ ] Verify lockable cabinet is functional
- [ ] Inspect fireproof safe for damage
- [ ] Check window coverings for damage or gaps
- [ ] Assess screen positioning for visitor visibility
- [ ] Review clean desk policy compliance
### Visitor Management
- [ ] Review visitor log (if any visits occurred)
- [ ] Assess visitor access procedures effectiveness
- [ ] Update visitor management procedures if needed
### Remediation Actions
- [ ] Document any deficiencies found
- [ ] Assign remediation tasks with deadlines
- [ ] Update Asset Register with any changes
- [ ] Schedule next monthly review
🎓 Training & Awareness
Physical Security Principles Layered Protection Approach:
Perimeter Security: Home office boundary (locked doors, windows secured)Equipment Security: Device locks, encryption, screen privacyInformation Security: Clean desk policy, secure disposal, classification awarenessEnvironmental Security: Fire/water/climate protectionBehavioral Security: Visitor awareness, situational awareness, incident reporting
Physical security is everyone's responsibility (even in single-person company)
"If you see something, say something" applies to physical threats too
Security controls are not obstacles—they protect business continuity
Transparency in security practices demonstrates professional maturity
Resources
Physical Security Policy: View on GitHub Asset Register: View on GitHub ISO 27001:2022 A.7: Physical and environmental security controlsNIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems
📋 Document Control
Version: 1.0Last Updated: 2026-02-10Review Cycle: AnnualOwner: Hack23 AB Security TeamClassification: 
