In short: Physical security awareness training teaches staff to protect information and premises in the real world: politely challenge tailgaters and unescorted visitors, keep a clear desk and locked screen, never plug in found USB drives, collect printing promptly and dispose of paper and old devices securely. It complements technical security and social engineering training.
Why physical security belongs in awareness training
Many social engineering attempts are physical: someone in a hi-vis jacket who 'just needs to check the comms cupboard', a courier who follows staff through a secure door, or a visitor left alone in a meeting room with a network port. Physical access often means access to devices, papers and networks.
The good news is that the habits are simple and visible. Once staff know what is expected, they reinforce each other. This topic fits naturally alongside social engineering training, which covers the psychology behind these approaches.
Tailgating and visitors
Tailgating (or piggybacking) is following an authorised person through a controlled door. It works because people are polite. Training should make challenging easy and normal:
- Do not hold secure doors open for people you do not recognise, however friendly.
- If someone follows you in, ask politely if you can help them and take them to reception.
- Expect all visitors to sign in, wear a visible badge and be escorted in non-public areas.
- Check contractors and engineers are expected: ask reception or facilities, and use a known contact, not a number the visitor gives you.
- Report anyone in a restricted area without a badge, even if they leave.
Staff should know that a polite challenge will always be backed by managers. Genuine visitors expect it.
Clean desk and locked screens
A clean desk policy reduces what a visitor, cleaner or passer-by can see or take. The essentials:
| Habit | In practice |
|---|---|
| Lock your screen | Every time you stand up. On Windows, the Windows key plus L; on a Mac, Control plus Command plus Q |
| Clear your desk | Confidential papers locked away at the end of the day and when you leave for a meeting |
| No passwords on notes | Not under the keyboard, not on the monitor, not in a desk drawer |
| Whiteboards and screens | Wipe whiteboards after meetings and check what is visible from windows and corridors |
| Devices | Laptops locked away or taken home overnight, phones never left unattended |
The same habits apply at home and on the move; see security training for remote and hybrid workers.
Found USB drives, chargers and other devices
A USB drive left in a car park or reception is a classic test, and some people will plug it in out of curiosity or kindness, hoping to find the owner. A malicious device can install malware or behave like a keyboard and type commands.
- Never plug in a found USB drive or any other device. Hand it to IT.
- Only use USB drives the organisation has issued, and encrypt them if you must carry data
- Do not accept free USB sticks or gadgets at events for use on work devices
- Use your own charger and plug rather than public USB charging points or borrowed cables
- Report any unexpected device plugged into a computer, printer or network port
IT can also block or control removable storage on managed devices, which makes the training rule easier to follow.
Printing, post and secure disposal
Paper and old devices are a frequent source of data breaches. Staff should:
- Collect printing straight away, or use secure 'pull' printing that releases a job only when you are at the printer
- Check envelopes and post before sending, especially mail merges
- Use confidential waste bins or shredders for anything containing personal or business information
- Never put old laptops, phones, hard drives or USB sticks in the bin; return them to IT for secure data destruction
- Report lost papers or misdirected post as quickly as a misdirected email
Personal data on paper is covered by UK GDPR just like digital data, so these habits also support GDPR training for staff.
How we help
We add a short physical security module to your programme, tailored to your premises: a shared office, a shop floor, a school, a surgery or a factory. For organisations with shared terminals and staff away from desks, see our pages for retail and hospitality and manufacturing.
Contact us to add physical security awareness to your training.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is tailgating in security?
Tailgating is when an unauthorised person follows an authorised person through a secure door or barrier, relying on politeness. Staff should not hold secure doors open for people they do not recognise and should politely direct them to reception.
What is a clean desk policy?
A clean desk policy asks staff to clear confidential papers and devices from their desk when they are away and at the end of the day, lock their screen whenever they step away, and never leave passwords written down. It reduces what visitors and passers-by can see or take.
What should you do if you find a USB stick?
Do not plug it into any computer, even to find the owner. Hand it to IT or your security contact. Malicious USB devices can install malware or act like a keyboard to run commands.
How should old devices and documents be disposed of?
Paper containing personal or business information should go in confidential waste or a shredder. Laptops, phones, hard drives and USB sticks should be returned to IT for secure data destruction, never thrown away or sold on without being wiped properly.