Physical access controls for a registrar's office
Every clause in the scenario is a vulnerability placed there deliberately: the student workers, the receptionist with full record access, the wireless mobile devices, and the neighbouring offices. Work from those rather than from a generic control list.
Editorial process
Last reviewed · August 15, 2026
The office layout is the threat model
Read the scenario as a threat model rather than as background, because each clause was put there to be found. Two student workers have physical presence in an office holding protected records, and student workers are peers of the record subjects, which is a conflict of interest as much as an access problem. The receptionist has a desktop with access to student records purely for scheduling, which is a plain least-privilege failure: scheduling needs names and times, not grades or holds. The assistant registrars reach a server over wireless on mobile devices, so the data leaves the wired perimeter and the devices themselves leave the building. And the office is near several other office spaces, which means shoulder surfing, tailgating through a shared door, unattended screens and printer output collected by whoever passes. None of those is exotic, and all of them are in the scenario because somebody put them there.
Structure the recommendations against those findings rather than reciting a control catalogue. Physical safeguards: a controlled perimeter with badge access and logging, screens angled or privacy-filtered away from the public counter, automatic session lock, a locked shred bin and secured print release, visitor sign-in, and a clean-desk rule that someone actually checks. Then the audit question: what you log, how long you keep it, who reviews it and how often, and — the part usually missed — that a log nobody reads is not a control. For the wireless devices, recommend enterprise authentication rather than a shared key, device encryption, mobile device management with remote wipe, and no local storage of records. Tie every recommendation back to FERPA rather than to good practice in general, since the scenario names the statute and the college hired you for that reason. Use a recognised control framework so the paper cites a standard rather than your own opinion.
Likely learning objectives
Inferred from the brief — check these against your own rubric.
- 01Derive a threat model from a described environment rather than from a generic checklist.
- 02Apply least privilege to a specific role's actual task.
- 03Recommend audit controls including who reviews them and how often.
- 04Connect each safeguard to a statutory requirement rather than to best practice alone.
Read the full question
Review every instruction before using the planning guidance that follows.
Course-wide instructions that accompany this question
You must proofread your paper. But do not strictly rely on your computer’s spell-checker and grammar-checker; failure to do so indicates a lack of effort on your part and you can expect your grade to suffer accordingly. Papers with numerous misspelled words and grammatical mistakes will be penalized. Read over your paper – in silence and then aloud – before handing it in and make corrections as necessary. Often it is advantageous to have a friend proofread your paper for obvious errors. Handwritten corrections are preferable to uncorrected mistakes. Use a standard 10 to 12 point (10 to 12 characters per inch) typeface. Smaller or compressed type and papers with small margins or single-spacing are hard to read. It is better to let your essay run over the recommended number of pages than to try to compress it into fewer pages. Likewise, large type, large margins, large indentations, triple-spacing, increased leading (space between lines), increased kerning (space between letters), and any other such attempts at “padding” to increase the length of a paper are unacceptable, wasteful of trees, and will not fool your professor. The paper must be neatly formatted, double-spaced with a one-inch margin on the top, bottom, and sides of each page. When submitting hard copy, be sure to use white paper and print out using dark ink. If it is hard to read your essay, it will also be hard to follow your argument.
Turn the brief into deliverables
- 01A 3-5 page paper with recommendations for the described office.
- 02Physical access control safeguards tied to identified vulnerabilities.
- 03Audit control recommendations including retention and review.
- 04Technical safeguards for the wireless and mobile access path.
- 05Citations to FERPA and a recognised control framework.
Physical, audit, then the wireless problem
Threat model from the scenario
Convert each described role, device and adjacency into a named vulnerability.
Physical access controls
Recommend perimeter, screen, print, disposal and visitor controls with justification.
Least privilege by role
Specify what the receptionist and student workers should and should not reach.
Audit controls
Define what is logged, retained, reviewed, by whom and how often.
Wireless and mobile safeguards
Address authentication, encryption, device management and local storage.
Sources for FERPA and control frameworks
Recommended databases
- U.S. Department of Education student privacy resources
- NIST Computer Security Resource Center
- Cybersecurity and Infrastructure Security Agency
- ACM Digital Library
Search sequence
- 1.Read what FERPA actually requires before recommending anything, since the paper's authority rests on it.
- 2.Select a control framework and cite specific control families rather than describing measures loosely.
- 3.Look up guidance on physical security for shared-tenancy offices, which is the adjacency problem in the scenario.
- 4.Check current recommendations on wireless enterprise authentication, which have changed with newer standards.
Reference shortlist
These are authoritative starting points, not a ready-made bibliography. A qualified reviewer must confirm that each source fits the assignment and supports the claim beside which it is cited.
Nothing here is cleared for citation until you have read it.
- 01
FERPA | Protecting Student Privacy
U.S. Department of Education · 2024
The statute itself and the Department's guidance, which is the authority every recommendation should trace back to.
- 02
SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
NIST Computer Security Resource Center · 2020
A control catalogue with named families for physical access, audit and accountability — cite controls rather than opinions.
- 03
Physical Security
Cybersecurity and Infrastructure Security Agency · 2024
Government guidance on physical security in shared and public-facing premises, which is the adjacency risk here.
- 04
Cybersecurity Framework
National Institute of Standards and Technology · 2024
A framework for organising the recommendations into identify, protect, detect and respond rather than a flat list.
Review before submission
Common mistakes
- Producing a generic security checklist that ignores the scenario's specific roles and layout.
- Missing the receptionist's excessive access, which is the clearest least-privilege failure.
- Recommending logging without saying who reviews it, which leaves the control incomplete.
- Treating the wireless mobile access as equivalent to the wired desktops.
- Citing good practice rather than FERPA, when the statute is why the college hired you.
Submission checklist
- Have you named a vulnerability for each element of the scenario?
- Is least privilege applied to the receptionist and the student workers?
- Do your audit recommendations name a reviewer and a frequency?
- Are the mobile and wireless paths addressed separately?
- Is each recommendation tied back to FERPA?
Use this guide to plan and review your own work. Follow your institution's rules and read our academic-integrity policy.
Written by
Aaron Bishop
MA, Education
assignment interpretation and research-methods coaching across disciplines
Aaron leads the EssayCrackers editorial desk. He works on how assignment briefs are read — what a rubric is actually asking for, and where students most often answer a different question than the one set.
Reviewed by
Dr. Nathan Cole
PhD, Rhetoric & Composition
Argumentation and thesis development
Nathan teaches first-year composition and directs a university writing center. He reviews EssayCrackers guides for argumentative soundness and citation accuracy.