Physical security

PHY023

Building construction

Before your organisation leases or constructs any premises, assess the construction methods and materials to find out if they will give the protection you need.

Increasing the level of building security afterwards may be expensive or impossible.

Domestic versus commercial building construction

Typically, buildings are constructed to the New Zealand Building Code. Some older buildings may not meet this code.

Domestic construction provides little protection from unauthorised access. Intrusion for theft is the most common type of unauthorised access. Skilled covert access is normally very hard to detect in domestic situations.

Standard commercial offices normally provide more perimeter protection than domestic buildings. However, internal walls, false ceilings, and other common building techniques reduce your ability to protect information and physical assets.

Most commercial office spaces are only suitable for protecting assets and information with a Business Impact Level (BIL) of medium or below.

Adding extra protection with building hardening

If your risk assessment shows you need to add building elements to address specific risks, building hardening may provide some level of mitigation.

Some examples of building hardening are:

blast mitigation measures
forcible attack and ballistic resistance
road and public access paths
lighting (in addition to security lighting)
hostile vehicle mitigation
elements of Crime Prevention Through Environmental Design (CPTED).

Using slab-to-slab construction

Slab-to-slab construction prevents access through false ceilings. The walls are joined directly to the floor and to the bottom of the next floor or the roof structure.

Where you must use slab-to-slab construction

Your organisation must use slab-to-slab construction at the perimeter of security zones, including all access points.

For details on slab-to-slab construction methods, see the NZSIS Technical Note - Physical Security of Intruder Resistant Areas. This note is classified. Contact the PSR team for more information.

Structural changes can affect the integrity of buildings, so seek structural engineering advice before you implement slab-to-slab construction.

When you can go without slab-to-slab construction (with care)

Your access points for zone 1 and zone 2 may vary between business hours and after hours. For example, from internal points (such as controlled office entry points) during business hours to the perimeter of the building or premise after hours (such as the main door).

You can use access points for zone 2 during business hours without slab-to-slab construction when the out-of-hours access point has slab-to-slab construction.

Alternatively, you can install an intruder-resistant layer in the ceiling, such as steel mesh, to address the problem of removable false ceiling panels when you need intrusion delays for specific rooms.

Be aware that these measures don’t give any protection from over-hearing, so you must not use them where you need speech security.

You can also use tamper-evident building techniques to provide some indication of unauthorised access.

Constructing zone 3 and zone 4 perimeters

For information on constructing zone 3 and zone 4 areas to store protectively-marked information or aggregations of information with a Business Impact Level (BIL) of very high damage, refer to NZSIS Technical Note - Physical Security of Secure Areas.

As this technical note is a classified document, contact the PSR team for more information.

Constructing zone 5 perimeters

For information on constructing zone 5 areas to store TOP SECRET information or aggregations of information with a Business Impact Level (BIL) of catastrophic damage, refer to NZSIS Technical Note - Physical Security of Zone 5 Areas.