Physical security for small and distributed offices

The server closet doubles as the supply closet. The cleaning crew has a key. The door is propped open in summer because the closet runs hot, and the network switch that carries every credit card transaction, payroll file and customer record sits 3 feet from the paper towels. Meanwhile the leadership meeting is debating a firewall upgrade.

This is the standard physical security posture of the 10-30 person office, and it is not because anyone decided it. Physical security never gets decided. It accretes: locks from the previous tenant, keys copied as people got hired, a camera someone bought after a break-in 6 years ago that nobody can log into anymore.

The good news is that physical security for a small office is cheap compared to almost everything else in security, and the priority order is clear. Here is how we think about it, in the sequence that pays off fastest.

Priority 1: keys and who still has them

Start with an uncomfortable question: how many keys to your office exist, and can you list who holds them?

Most small businesses cannot. Mechanical keys get copied, lent and forgotten, and they do not expire when employment does. If a departed employee’s badge or key was never collected, your office has the physical equivalent of an active login for someone who left 2 years ago. Key collection belongs on the same offboarding checklist as account termination, and the honest fix for years of drift is a rekey, typically a few hundred dollars for a small office and worth every cent for the certainty.

The durable answer is electronic access control. Cloud-managed door controllers run roughly $1,000 to $2,500 per door installed, plus modest monthly fees. What that buys:

• Credentials that deactivate the day someone leaves, from a browser, in seconds
• An audit log of who opened which door when
• No more “we should really change the locks” conversations after every departure
• Schedules, so the back door locks itself at 6 pm instead of relying on the last person out

For a typical small office, 2 or 3 controlled doors (main entry, server closet, records room) covers the real risk.

Priority 2: the server closet

The closet holding your switch, firewall, server and backup device deserves its own lock and its own short list:

• A door that locks and stays locked. Access limited to the 2 or 3 people with a reason. If the cleaning crew needs the supply shelf, move the supplies, not the servers.
• Cooling that does not depend on the door being open. A propped door is an unlocked door. A $300 exhaust fan solves the problem that created the habit.
• A UPS on everything. Power protection is physical security for your uptime, and unplanned shutdowns are how storage dies.
• Cable and port hygiene. No live network jacks in the lobby or conference room patched straight into the LAN. An attacker with 30 seconds and a laptop should not be able to jack into your network from the waiting area.

If a visitor could reach your core switch with a screwdriver in under a minute, the firewall discussion is premature.

Priority 3: cameras that someone can actually use

The 6-year-old DVR with a forgotten password is not a camera system, it is set dressing. Modern cloud-managed cameras changed the economics: expect roughly $150 to $500 per camera plus licensing, with footage viewable from a phone, retained off-site and exportable in minutes when an insurer or police report needs it.

Coverage that matters for a small office:

• Entrances and exits, capturing faces at door height
• The server closet door
• Receiving areas or anywhere inventory and checks are handled

Skip the urge to blanket the office. 4 well-placed cameras beat 16 unwatched ones, and employees resent surveillance theater. Point cameras at doors and assets, not desks.

Priority 4: the human patterns

Hardware is the easy half. The habits are where small offices actually leak:

• Tailgating. Someone in a delivery vest carrying boxes gets held the door by every polite employee in America. The fix is cultural permission: it is okay to ask “who are you here to see?” and to walk visitors to their destination.
• Unescorted vendors. The copier tech, the HVAC contractor and the water delivery all move through the office unaccompanied. Most are exactly who they appear to be. The policy of escorting them costs nothing and closes the gap for the one who is not.
• Visible information. The whiteboard facing the lobby with this quarter’s customer names. The reception monitor showing an inbox. Screens visible through ground-floor windows. Do the walk-through: stand where a visitor stands and read what they can read.
• Clean desk for the few things that matter. Checks, HR files and anything with account numbers go in a locked drawer overnight. This is a 2-minute habit, not a culture program.
• Found USB drives. A drive in the parking lot goes in the trash or to IT, never into a workstation. This is a standing item in security awareness training because it keeps working on people who have not been told.

Distributed and hybrid offices: multiply, then simplify

If you run 2 or 3 small locations, the problems above multiply and the oversight thins. Nobody at headquarters knows the branch propped the back door. The principles that keep multi-site physical security manageable:

• Cloud-managed everything. Door access and cameras administered from one dashboard, so revoking a departed employee covers every site in one action, and the branch does not need an IT closet expert on staff.
• Same standard, every site. One access policy, one camera placement standard, one visitor rule. Site-by-site improvisation is how gaps appear.
• The remote-work boundary. For employees working from home, do not try to physically secure their houses. Secure the device and the identity instead. That model, and where the office perimeter genuinely ends, is the subject of our remote-first security guide.

Write down what exists

Whatever you deploy, document it: which doors are controlled, who administers the platform, where camera footage lives, who holds physical master keys and the vendor contacts for each system. When the office manager who set it all up leaves, this is the difference between continuity and archaeology. It belongs in the same operational runbook as your network documentation, the one we argue every small business should be able to produce in the documentation test.

Physical security will never be the most interesting line in your security budget, and that is the point. For a few thousand dollars and a handful of habits, you close the attack paths that require no skill at all, the ones that walk in wearing a delivery vest.

Atticus Rowan folds physical security review into the same assessments that cover networks, identity and backups, because attackers do not respect the org chart between “IT security” and “facilities.” If your server closet has a mop bucket in it, we should talk.