Offices, warehouses, server rooms and any other physical space the organisation occupies or controls, along with the physical access controls (locks, badges, alarm systems) that protect them.

Physical security is often overlooked in cyber risk management, but several threats in the elementary threat catalogue — theft, unauthorised entry, fire, water damage — depend directly on how well premises are protected.