What is physical penetration testing?

Physical penetration testing is an authorized test of whether physical security controls work under realistic conditions. It may validate access control, visitor procedures, staff response, perimeter weaknesses, or restricted area controls, but only within a written Rules of Engagement and approved authorization.

What is the difference between a physical security assessment and a penetration test?

An assessment reviews access control, visitor procedures, the perimeter, cameras, lighting, and staff practices through walkthroughs and interviews. A penetration test goes further: under written authorization and Rules of Engagement, it checks whether those controls hold up when someone tries to get past them. Many organizations start with an assessment and add testing later.

Who needs a physical security assessment in Oklahoma?

Businesses, churches, schools, warehouses, construction sites, property owners, apartment communities, offices, executives, and organizations may need a physical security assessment when they are concerned about unauthorized access, theft, trespass, employee safety, visitor control, cameras, lighting, or recurring incidents.

What standards do you frame assessments against?

PTES for procedural structure, OSSTMM for physical channel coverage, NIST SP 800-115 for assessment program vocabulary, NIST SP 800-53 PE controls for findings mapping, NFPA 730 for layered defense, CPTED for environmental design, OSHA Pub 3148 for workplace violence, and the ASIS PSP body of knowledge for evaluator skills.

Is physical penetration testing legal?

Yes, when properly authorized. Testing is performed only under a written Rules of Engagement and a signed authorization letter from an officer of the client with property control. For leased space, a property owner signature is also typically required. Scope, locations, methods, timing, safety limits, and emergency contacts are defined before testing begins.

Is your physical security assessment work licensed by CLEET?

Pure assessment and consulting work is not, by itself, a CLEET licensed activity in Oklahoma. SCOPE is a CLEET-licensed security agency, and any work that crosses into private investigation, security guarding, armed protection, or off duty officer engagement is performed only under the appropriate CLEET license.

Who must sign the authorization letter?

An officer of the client with property control, such as a C suite officer or a person with written delegation from the C suite. If the facility is leased or shared, the property owner is typically also required to sign so the engagement aligns with the actual property ownership chain.

What areas are reviewed during a facility security assessment?

Common review areas include entrances, exits, locks, gates, fences, parking, lighting, cameras, alarms, visitor procedures, employee access, restricted rooms, delivery points, server rooms, records rooms, and exterior approach paths.

Can a physical security assessment include cameras and lighting?

Yes. Camera placement, blind spots, lighting coverage, visibility, monitoring practices, and incident review limitations can be part of the assessment when included in scope.

Can SCOPE test whether someone can enter my building?

Only if the client has authority to approve that testing and the activity is clearly authorized in writing. Testing limits, safety rules, areas, dates, methods, and trusted agent contacts are defined before any attempt is made.

Will employees know about the assessment?

It depends on the scope. Some assessments are announced and cooperative. Authorized physical penetration testing is usually unannounced to most staff, with two or more trusted agents aware so safety boundaries and escalation work as intended.

What does the final report include?

An executive summary, assessment scope, authorization limits, areas reviewed, access control findings, perimeter observations, camera and lighting notes, visitor procedure findings, risk priorities, photo references, limitations, NIST SP 800-53 PE control mapping, and recommended improvements.

What happens if real police, fire, or EMS arrive during a test?

The test ends immediately. The assessor identifies, surrenders the authorization letter, and requests verification by phone with the named authorizing officer. Disengagement is the standard, not continued pretext.

Can SCOPE provide physical security assessments outside Oklahoma City?

SCOPE is based in central Oklahoma and serves the Oklahoma City and Tulsa metros plus surrounding communities. Coverage outside the OKC and Tulsa metros is reviewed at intake based on travel, urgency, facility type, authorization, testing scope, and case needs.

Physical Security Assessment · Oklahoma City

Physical Security Assessment

Authorized physical security evaluations and physical penetration testing for Oklahoma organizations that need to understand facility weaknesses, access control gaps, visitor procedures, perimeter exposure, and real world security risk before an incident occurs.

Request a Security Assessment Consultation See How an Assessment Works

Authorized TestingWritten ROE before any field work
Standards AlignedPTES, OSSTMM, NIST, NFPA, CPTED
Clear Risk DocumentationFindings prioritized for leadership
Oklahoma FocusedOKC metro and central Oklahoma

Physical Security Assessment Explained

Assessment Clarity

What a physical security assessment actually is, how authorized testing fits inside it, and how observations become a written report leadership can act on.

Most organizations do not fail because they have no security at all. They fail because controls are incomplete, inconsistent, outdated, ignored, poorly documented, or have never been tested under realistic conditions.

A structured assessment combines the procedural rigor of PTES and NIST SP 800-115, the physical channel coverage of OSSTMM, the field discipline of CPTED and NFPA 730, and findings mapped to the NIST SP 800-53 PE control family so the report you receive is both defensible and actionable.

Authorized Methods Only
Standards Aligned
Findings Mapped

Decisions On Paper

Scope

Scoped

Scoping defines the engagement before anyone walks the site. Facility, concern, authority, in scope and out of scope methods, blackout dates, trusted agents, and emergency stop procedures are written down so the work that follows can stay focused.

What Was Reviewed: Facility, sites, stakeholders, authority, prior incidents, and applicable standards.
What Was Verified: Scope and methodology are confirmed against client objectives and the authorization chain.
What You Receive: A written scope, a signed Rules of Engagement, and an authorization letter ready for execution.

Oklahoma Standards

Standards

Oklahoma practiced, externally framed. PTES procedure, OSSTMM physical coverage, NIST SP 800-115 and 800-53 PE control mapping, NFPA 730 layered defense, CPTED field discipline, ASIS PSP body of knowledge, OSHA Pub 3148 for workplace violence, and CLEET separation for any licensed work.

Physical security assessment in Oklahoma is grounded in two things. First, the external standards that frame the work itself: PTES, OSSTMM, NIST SP 800-115 and 800-53 PE, NFPA 730, CPTED, ASIS PSP, and OSHA workplace violence guidance. Second, Oklahoma CLEET licensure for any activity that crosses into investigation, guarding, or armed protection.

Before any field work begins, a serious practice walks the prospective client through scope, authorization, methods, deliverables, and the line between consulting work and licensed activity. That conversation is part of how the engagement protects the client.

Standards BaselinePTES · OSSTMM · NIST · NFPA · CPTED · ASISContinuing EducationRecognized professional standards in physical security assessment include PTES, OSSTMM PHYSSEC, NIST SP 800-115, NIST SP 800-53 PE controls, NFPA 730, CPTED, OSHA Pub 3148, and the ASIS PSP body of knowledge.

A serious assessment promises a written, standards aligned, defensible process. The deliverable is documented analysis that helps the client decide what exposure is worth addressing first.

CLEET Separation

Standard 01 / 04

What to Ask: Ask which CLEET licensure the firm holds for adjacent work, and how the line between assessment and any licensed activity is maintained inside a single engagement.
What a Professional Explains: A professional can explain that consulting and assessment are not regulated under Title 59 on their face, while any work that crosses into private investigation, security guarding, armed protection, or off duty officer engagement requires the appropriate CLEET license. SCOPE is a CLEET-licensed security agency.
Why It Matters: Scope separation protects the client. It keeps the assessment report defensible and keeps any licensed activity inside the Oklahoma framework that requires it.

Physical Security Clients

Client Command

Every engagement starts with a different facility and a different concern, and a strong assessment starts with intake. The facility, the stakeholders, the inciting concern, the authority, and the deliverable are clarified before any field work begins.

Before Intake

Clarify the Question
Bring What You Have
Stay Authorized

Assessment Path

Common Concern: A residence or executive office where access, visibility, visitor screening, parking and arrival exposure, or privacy risk needs a structured outside review.
Helpful Assessment Work: Residential and office walk down, access point review, visitor screening recommendations, exterior and approach assessment, and practical protective planning aligned with any executive protection engagement.
What to Prepare: Residence or office layout, known concerns, travel patterns, prior incidents, public exposure, access points, gate or entry procedures, camera coverage, and preferred privacy limits.
Useful Output: A written assessment, a prioritized recommendation roadmap, and hardening recommendations for the residence, the office, and the daily routine.

Common Concern: Litigation, premises liability, post incident analysis, insurance underwriting, claim documentation, or counsel preparing for trial where physical security conditions need to be objectively documented.
Helpful Assessment Work: Objective site observation, photographic reference where appropriate, written findings, clear statement of limitations, and reporting formatted for counsel or carrier review.
What to Prepare: Case objective, property address, incident date, relevant documents, requested observations, legal deadlines, areas to avoid, and reporting format expectations.
Useful Output: A written assessment with documented limitations, photographic reference where appropriate, and findings sized for counsel review or carrier discussion.

Common Concern: A recent incident, recurring shrink or trespass, an upcoming insurance audit, an expansion or move, a board level question with no documented answer, or a workplace violence concern that needs a structured response.
Helpful Assessment Work: Facility security assessment, vulnerability assessment, access control review, authorized physical penetration testing where in scope, policy review, training design, and an executive briefing.
What to Prepare: Site list, floor plans, current technology inventory, existing policies and post orders, incident history, lease documents, integrator contracts, and any carrier or audit requirement.
Useful Output: A written risk register, a phased roadmap, performance specifications for any RFP, and an executive briefing built for leadership and the board.

ComplianceCompliance work that touches PCI, HIPAA, or other regulated frameworks is mapped against the applicable standard. Statutory interpretation remains with counsel.

Common Concern: Premises liability, recurring trespass or vandalism, tenant complaint patterns, an upcoming public event, portfolio standardization across dispersed sites, school or faith institution active threat planning, or after hours exposure on large industrial sites.
Helpful Assessment Work: CPTED walk down, written property assessment, perimeter and lighting review, portfolio standardization, policy drafting for property staff, and tenant or congregation communication framework.
What to Prepare: Property list, site plans, lighting and landscape plans, prior assessments, incident logs, lease and rule documents, vendor contracts, and any open insurance or counsel requirement.
Useful Output: A written assessment per property or site, a portfolio standard, a prioritized recommendation roadmap, CPTED observations, and policy drafts ready for staff or volunteers.

Core Physical Security Services

Core Services

Eight advisory and assessment practices, each built around a defined scope, written authorization where field testing is involved, and a written deliverable that supports a real decision.

Every engagement starts with intake. The facility, the stakeholders, the inciting concern, the applicable standards, and the decision the work is meant to support are clarified before any field work begins.

From there, the engagement is scoped around the actual exposure. Methods are matched to authorization. Walk downs, control tests, and reports are framed against recognized standards so the deliverable is both defensible and useful.

Select a service zone to see the objective, methods, and deliverables.

Facility Security Assessment

Service 01 / 08

Best Used For: Organizations needing a practical security review of a single site or facility against CPTED, NFPA 730, and the NIST 800-53 PE control family.
May Include: Access point and perimeter observations, lighting review, visitor procedure review, restricted area review, and camera placement observations.
Client May Receive: A written facility security report with findings, risk categories, photographs where appropriate, and recommended next steps.

AccessPerimeterVisibilityProcedure

IntakeA facility assessment is often the first engagement. It establishes a baseline you can compare every later change against.

How the Process Works

The Process

Six structured stages that scope and authorize the work, build evidence on site, validate controls where in scope, and produce a written report leadership can act on.

Advance through each stage of an assessment engagement.

Assessment Stage · INTAKE

Confidential Intake

Stage 01 / 06

A mutual NDA is signed. You explain the facility, the operating environment, the inciting concern, prior incidents, sensitive areas, operating hours, and the outcome you want.

Client Role: Be ready to discuss the facility, the stakeholders, prior incidents, current controls, applicable standards, and any deadline driven by counsel, the carrier, or the board.
Assessor Role: Listen carefully, clarify the objective, identify missing information, and determine whether the engagement is an assessment, an authorized test, a post incident review, or a hybrid.
Expected Result: A clear understanding of the engagement and what the client needs to learn.

FacilityConcernStandardsDecision

What Security Assessors Can and Cannot Do

Boundaries

A serious practice protects the client by staying inside the written scope, refusing methods that create legal or safety exposure, and aligning every test with the property ownership chain.

Physical security assessment in Oklahoma is governed by a written Rules of Engagement and a signed authorization letter from an officer with property control. The methods that are permitted depend on what the document authorizes, and the methods that are rejected are the ones that would compromise the engagement.

The strongest assessment is the one that produces useful findings without creating new exposure for the client, the staff, or the assessor. The discipline of the document is the discipline of the engagement.

A signed authorization letter is not legal immunity. It is evidence of consent that aligns the engagement with the property ownership chain.

Test each request against the boundary line.

Permitted Methods

Rejected Methods

Site Walk Down

Lawful When Authorized

Walk downs and observations conducted at the client invitation, with permission to photograph and document conditions for the engagement record.

Service Area

Statewide Oklahoma coverage with primary reach across the OKC and Tulsa metros, reviewed at intake based on travel, urgency, facility type, authorization, scope, and reporting needs.

SCOPE is based in central Oklahoma and provides physical security assessment across the Oklahoma City and Tulsa metros, the I-35 and I-44 corridors, and the surrounding counties. Coverage is reviewed before work begins so the sites, the timeline, the authorization chain, and the scope of testing are clearly understood.

Select a city marker to review coverage.

Intake Review ConsoleOklahoma CityPrimary Coverage

Intake Review

Central access supports practical planning across the OKC metro, including downtown, Bricktown, Midtown, the medical campuses, and major business and education sites.

Next StepBegin intake to confirm facility, authorization, scope, and reporting needs.

What Intake Reviews

Travel
Urgency
Authorization
Scope

When to Request a Security Assessment

The Signals

A physical security assessment helps most before a decision has to be made under pressure. The earlier exposure is documented, the smaller and cheaper the next decision usually becomes.

Most calls do not come from organizations that already know what to do. They come from organizations whose situation has shifted, whose controls have drifted, or whose visibility has grown to the point where leadership wants a written answer instead of a guess.

A consultation defines what is happening, what authorization is needed, what an honest assessment would cover, and which deliverable would help most.

A consultation is informational. It defines what may be in scope, what authorization is needed, and what a realistic written assessment could look like.

Select a developing signal to see what it may mean.

You Do Not Know If Your Building Is Actually Secure

Signal Developed

What It May Indicate: The site has controls on paper but no documented posture. Leadership cannot answer simple questions about exposure without a structured outside review.
What to Document Now: Floor plans, list of current controls, vendor and integrator contracts, current policies, and any prior assessment if one exists.
How a Consultation Helps: It defines whether a facility security assessment, a control review, or an authorized test is the right next deliverable.

ControlsPostureUnknown

Evidence, Reports, and Documentation

Reporting

A physical security assessment becomes useful when site overview, control review, findings, and recommendations are organized into a clean engagement archive the client can defend in front of a board, a carrier, an auditor, or counsel.

A consulting deliverable is the artifact that survives the meeting it is presented in. Site overview, control review, findings, and recommendations each produce written records that sit behind the engagement and outlive it.

A professional report turns walk down notes, test logs, and document review into something the board, the owner, the operator, or counsel can actually read, share, and rely on for the next decision.

The goal is not to bury the client in paperwork or fear language. The goal is to organize the right records so the engagement can be reviewed, defended, and improved over time.

Select a documentation band to see how the record is built.

Assessment ReportAssembling

Executive Summary
Facility Overview
Assessment Scope
Authorization Limits
Areas Reviewed
Findings By Category
Risk Priority Levels
Photo References
Limitations
NIST 800-53 PE Mapping
Recommendations
Re Test Plan

Site Overview

Layer 01 / 04

Purpose: The report begins by identifying the facility, property type, operating environment, assessment purpose, and general scope.
Client Value: A clear site overview gives every later reader the context to read findings properly. It also documents who was authorized to receive the deliverable and what scope was reviewed.
What It May Include: Location, site type, date of assessment, areas reviewed, authorized contacts, operating hours, and known concerns.

Confidentiality and Discretion

Discretion

Confidential intake under NDA, controlled communication, sensitive findings handling, professional field conduct, and clean reporting from the first call through closeout.

A physical security assessment deliverable is a map of where an organization is exposed. If it leaks, it does not just embarrass the client, it can change the actual risk picture by giving someone a starting point.

A serious practice treats confidentiality as part of the work, not a feature. NDA, scope limitation, secure transmission, photographic evidence handling, retention discipline, and conflict screening all sit inside the same engagement standard.

Privacy is operational. The practice protects what it learns by limiting who sees it, how it moves, and how long it is kept.

Confidentiality is explained clearly at intake, including authorized recipients, transmission channels, photographic evidence handling, retention or destruction schedule, and how a subpoena or compelled disclosure would be handled.

Open each privacy layer to see how discretion is protected.

Open evidence kit with sample tubes and bags, one tube held in a gloved hand

Layer Protected

Private Intake

01 / 05

What It Means: The first conversation focuses on the facility, the concerns, prior incidents, sensitive areas, authority, and desired outcome, under a mutual non disclosure agreement.
Why It Helps: A private intake lets leadership describe weaknesses honestly. Honest input produces an honest assessment.
Intake Note: Bring site overviews, known concerns, prior incidents, and the leadership owner who will receive the report.

Questions

Straightforward answers to the questions we hear most. A consultation is the right place to talk through your specific situation.

15/ 15questions

What is a physical security assessment?

A physical security assessment is a structured review of a facility physical security posture. It may evaluate access control, doors, locks, lighting, cameras, visitor procedures, staff habits, perimeter conditions, restricted areas, emergency procedures, and documentation practices, framed against recognized standards.

Why an Oklahoma Security Assessor

Why SCOPE

Oklahoma based assessment work built around confidential intake, written authorization, standards aligned methods, lawful field conduct, clear communication, and reports leadership can act on.

Oklahoma physical security work benefits from real local understanding. Metro businesses, rural properties, churches, schools, warehouses, construction sites, and private facilities face different access, travel, response, lighting, staffing, and perimeter conditions.

SCOPE is a disciplined Oklahoma focused practice. Intake is careful, authorization is honest, standards drive the structure, methods stay inside the written scope, and the deliverable is a report leadership can defend in front of a board, a carrier, an auditor, or counsel.

Credential Details

SCOPE is a CLEET-licensed security agency. Ask us for current license details for your assessment during intake.

Open each folio panel to inspect a SCOPE advantage.

Oklahoma assessment context reference image

Local Context

Oklahoma Knowledge

Local understanding helps the assessment ask better questions, recognize practical risk, and avoid generic recommendations. A metro office, a rural warehouse, a church campus, a school campus, and a construction site each call for a different lens.

Context Matters

Metro
Rural
Campus
Site

Start Here

If you need a physical security assessment or authorized physical penetration test in Oklahoma City or central Oklahoma, the first step is a focused intake conversation. Bring the facility address, site type, known concerns, prior incidents, operating hours, access control details, camera and alarm information, visitor procedures, sensitive areas, and the outcome you want from the assessment.

Tap to call(405) 902-8888

Start Security Assessment Intake Email a Physical Security Assessor

Confidential Intake
Authorized Testing
Standards Aligned
Clear Next Steps

Related Services

Physical security assessments often connect to other professional support services. Depending on the situation, you may also need security consulting, executive protection planning, private investigation, security officer coverage, background research, or a confidential consultation.

Select a related page to preview the next path and continue through the SCOPE site.

Select a destination to preview the related page before opening it.

Selected DestinationSecurity ConsultingIndependent, vendor neutral consulting for risk, master planning, policy, training, and program design.

See how risk is identified, how a program is reviewed, and how recommendations support safer planning, decision making, and operations.

RiskPlanProgram

Open

Understand protective planning, route awareness, site review, exposure reduction, and how protection work is scoped around actual risk.

PrincipalAdvanceCover

Open

Understand how a private investigation is scoped, what methods are lawful, what evidence can be documented, and how findings become a usable record.

FactsSurveillanceRecords

Open

See how security officer coverage is scoped, how posts and post orders are defined, and when armed or unarmed officers fit the risks a site presents.

OfficersPostsPatrol

Open

Understand who SCOPE is, what principles guide the work, and how professionalism, lawful methods, and clear documentation shape each engagement.

PrinciplesStandardsBackground

Open

Begin a private, professional first conversation where the facility, the authority, the scope, the testing limits, and the deliverable can be discussed.

IntakeScopeNext Step

Open

Physical Security Assessment

Assessment Clarity

Scope

Survey

Test

Report

Standards

CLEET Separation

Written Authorization

Rules of Engagement

Findings Mapped and Delivered

Client Command

Core Services

Facility Security Assessment

Physical Penetration Testing

Access Control Review

Perimeter and Exterior Security Review

Camera, Lighting, and Visibility Review

Visitor, Vendor, and Contractor Procedure Review

Post Incident Security Review

Security Report and Improvement Roadmap

Confidential Intake

Scope and Authorization

Facility and Control Review

Authorized Testing

Findings and Risk Prioritization

Report and Next Steps

Boundaries

Site Walk Down

Visitor Procedure Review

Camera and Lighting Review

Perimeter Review

CPTED Walk Down

Authorized Controls Test

NIST 800-53 PE Mapping

Written Reporting

Unauthorized Entry

Property Damage

Impersonate Officials

Real Weapons On Test

Engage First Responders

Protected Information

Create Panic or Unsafe Conditions

Operate Outside ROE

Guarantee Outcome

Service Area

The Signals

You Do Not Know If Your Building Is Actually Secure

Theft, Trespass, Or Suspicious Activity

Employees Bypass Security Procedures

Moving Into a New Facility

Workplace Violence or Safety Concern

Cameras or Lighting May Not Cover the Right Areas

Visitors and Vendors Move Too Freely

You Need to Protect Sensitive Areas

You Want Authorized Physical Penetration Testing

Reporting

Site Overview

Control Review

Findings

Recommendations

Discretion

Private Intake

Controlled Communication

Sensitive Findings Handling

Professional Field Conduct

Clean Reporting

Why SCOPE

Oklahoma Knowledge

Centrally Located

Confidential Intake

Standards Aligned

Professional Reports

Lawful Methods

Start Here

Explore More