Scope, ethics & authorization
Physical security testing must **always** be formally authorized, clearly scoped, and performed under a written policy or contract. Authorization should define boundaries: facilities, time windows, contact points, escalation procedures, and prohibited tactics. Never perform lock, entry, or tailgating tests without documented consent and coordination with legal, HR, and security management.
The first and most critical phase of any physical test.