Unit 2 Scenario 2A: Securing Xtensr Labs
Xtensr Research Labs is acquiring Meridian BioAnalytics, a smaller research company across town, to expand its genomics operations. You've been assigned to the physical security team supporting the acquisition.
Across the five cases below, you will review the facility's building plans and current security controls, identify physical vulnerabilities, assess the risk each one poses, recommend physical controls to mitigate them, and recommend where to place monitoring equipment to detect breaches.
Work through the cases in order — each one builds on the vulnerabilities and risk ratings you identify earlier. Every text box autosaves as you type.
Site Survey & Vulnerability Identification
Meridian BioAnalytics never handled data or materials considered high-value targets, so its physical security has drifted for years: small fixes get deferred, and inconvenient controls get quietly worked around by staff. Once Xtensr's genomics division moves in, this building will house a proprietary sequencing lab and a server room holding unpublished research data.
You walked the site with Meridian's facilities manager and logged what you observed. The Facility Survey Log below records each location, what you observed, and the control currently in place. Click a row's Flag pill to mark it as a vulnerability worth carrying into your risk assessment.
| Location | Observation | Current Control | Flag |
|---|
Risk Assessment
A vulnerability isn't automatically a crisis — it becomes a priority based on how likely it is to be exploited and how severe the consequences would be if it were. Consider impact in terms of research data loss or theft, disruption to lab operations, regulatory exposure, and physical safety.
For each vulnerability below, set a Likelihood and Impact rating. The Risk Level updates automatically using the matrix your instructor has taught in class.
| Vulnerability | Likelihood | Impact | Risk Level |
|---|
Control Recommendations
Xtensr's leadership wants a prioritized, budget-aware set of physical controls — not a wish list. As you select controls, think about what type each one is: preventive (stops an incident), detective (notices one happening), deterrent (discourages an attempt), or corrective (fixes a broken control so it works as intended).
Click Recommend on every control from the catalog below that you want to include in your remediation plan.
| Candidate Control | Type | Cost Tier | Recommend |
|---|
Monitoring Equipment Placement
Controls try to stop an incident before it happens. Monitoring equipment assumes something might get through anyway, and is designed to detect it and trigger a response. Click a zone on the floor plan below to cycle through equipment options: None → Camera → Motion Sensor → Door/Window Contact → None.
| Zone | Equipment Assigned |
|---|
Executive Summary
Leadership doesn't need the full survey log — they need to make a decision. Translate your assessment into language a non-technical executive can act on.