Physical security is the DISP domain people either overbuild or ignore. Neither works. Defence expects facility measures proportional to the classification you are accredited to handle — from basic access control at OFFICIAL through to accredited zones at higher levels.
Proportional, not theatrical
You do not need a vault for Entry Level. You also cannot store PROTECTED material in an unlocked cupboard behind reception and call it a control. The test is whether a reviewer can see a facility story that matches the level on the application.
What usually sits at Entry Level
- Controlled access to the workplace, even if that is a small office
- A visitor process that is used, not laminated and forgotten
- Storage and handling rules for OFFICIAL and OFFICIAL: Sensitive
- Clear responsibility when staff take devices or paper off-site
What changes as the classification rises
Higher levels bring accredited zones, stricter access lists, and evidence that the zone is actually managed — not just labelled. If your business case does not require that classification, do not volunteer for the facility cost. Scope first using membership levels.
Evidence reviewers look for
Photos of a locked door are not a physical security program. Reviewers look for:
- Who can enter, who approves access, and how that is recorded
- How visitors and contractors are handled
- How classified or sensitive material is stored and destroyed
- What happens after hours and when the office is empty
- How physical controls connect to the Security Officer's reporting
Shared tenancies and industrial sites
Manufacturers and warehouse businesses often share sites. That is allowed if you can describe the boundary: which rooms, which cages, which people. Vague "we have a warehouse in Dandenong" does not survive a question from DSA.
Physical security fails when it is treated as a facilities ticket. It holds when it is part of the same engagement as governance, personnel, and ICT/cyber.