+PE-03 Physical Access Control
---+PE-03(01) System Access
---+PE-03(02) Facility and Systems
---+PE-03(03) Continuous Guards
---+PE-03(04) Lockable Casings
---+PE-03(05) Tamper Protection
---+PE-03(07) Physical Barriers
---+PE-03(08) Access Control Vestibules

PE-03 Physical Access Control

Control

Enforce physical access authorizations at [Assignement: entry and exit points] by:
1. Verifying individual access authorizations before granting access to the facility; and
2. Controlling ingress and egress to the facility using [Selection(one-or-more): {{ insert: param, pe-03_odp.03 }} ; guards];
Maintain physical access audit logs for [Assignement: entry or exit points];
Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignement: physical access controls];
Escort visitors and control visitor activity [Assignement: circumstances];
Secure keys, combinations, and other physical access devices;
Inventory [Assignement: physical access devices] every [Assignement: frequency] ; and
Change combinations and keys [Assignement: organization-defined frequency] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Discussion

Physical access control applies to employees and visitors. Individuals with permanent physical access authorizations are not considered visitors. Physical access controls for publicly accessible areas may include physical access control logs/records, guards, or physical access devices and barriers to prevent movement from publicly accessible areas to non-public areas. Organizations determine the types of guards needed, including professional security staff, system users, or administrative staff. Physical access devices include keys, locks, combinations, biometric readers, and card readers. Physical access control systems comply with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural, automated, or some combination thereof. Physical access points can include facility access points, interior access points to systems that require supplemental access controls, or both. Components of systems may be in areas designated as publicly accessible with organizations controlling access to the components.

Assessment Objective

1. physical access authorizations are enforced at [Assignement: entry and exit points] by verifying individual access authorizations before granting access to the facility;
2. physical access authorizations are enforced at [Assignement: entry and exit points] by controlling ingress and egress to the facility using [Selection(one-or-more): {{ insert: param, pe-03_odp.03 }} ; guards];
physical access audit logs are maintained for [Assignement: entry or exit points];
access to areas within the facility designated as publicly accessible are maintained by implementing [Assignement: physical access controls];
1. visitors are escorted;
2. visitor activity is controlled [Assignement: circumstances];
1. keys are secured;
2. combinations are secured;
3. other physical access devices are secured;
[Assignement: physical access devices] are inventoried [Assignement: frequency];
1. combinations are changed [Assignement: frequency] , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated;
2. keys are changed [Assignement: frequency] , when keys are lost, or when individuals possessing the keys are transferred or terminated.

Assessment Method

Examine

Physical and environmental protection policy procedures addressing physical access control physical access control logs or records inventory records of physical access control devices system entry and exit points records of key and lock combination changes storage locations for physical access control devices physical access control devices list of security safeguards controlling access to designated publicly accessible areas within facility system security plan other relevant documents or records

Interview

Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities

1. Übersicht

Bezeichnung	Standard
PE-03(01) System Access	Control Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignement: physical spaces]. Discussion Control of physical access to the system provides additional physical security for those areas within facilities where there is a concentration of system components. Assessment Objective physical access authorizations to the system are enforced; physical access controls are enforced for the facility at [Assignement: physical spaces]. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control physical access control logs or records physical access control devices access authorizations access credentials system entry and exit points list of areas within the facility containing concentrations of system components or system components requiring additional physical protection system security plan other relevant documents or records Interview Organizational personnel with physical access authorization responsibilities organizational personnel with information security responsibilities
PE-03(02) Facility and Systems	Control Perform security checks [Assignement: frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components. Discussion Organizations determine the extent, frequency, and/or randomness of security checks to adequately mitigate risk associated with exfiltration. Assessment Objective security checks are performed [Assignement: frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control physical access control logs or records records of security checks security audit reports security inspection reports facility layout documentation system entry and exit points system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-03(03) Continuous Guards	Control Employ guards to control [Assignement: physical access points] to the facility where the system resides 24 hours per day, 7 days per week. Discussion Employing guards at selected physical access points to the facility provides a more rapid response capability for organizations. Guards also provide the opportunity for human surveillance in areas of the facility not covered by video surveillance. Assessment Objective guards are employed to control [Assignement: physical access points] to the facility where the system resides 24 hours per day, 7 days per week. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control physical access control logs or records physical access control devices facility surveillance records facility layout documentation system entry and exit points system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-03(04) Lockable Casings	Control Use lockable physical casings to protect [Assignement: system components] from unauthorized physical access. Discussion The greatest risk from the use of portable devices—such as smart phones, tablets, and notebook computers—is theft. Organizations can employ lockable, physical casings to reduce or eliminate the risk of equipment theft. Such casings come in a variety of sizes, from units that protect a single notebook computer to full cabinets that can protect multiple servers, computers, and peripherals. Lockable physical casings can be used in conjunction with cable locks or lockdown plates to prevent the theft of the locked casing containing the computer equipment. Assessment Objective lockable physical casings are used to protect [Assignement: system components] from unauthorized access. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control list of system components requiring protection through lockable physical casings lockable physical casings system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-03(05) Tamper Protection	Control Employ [Assignement: anti-tamper technologies] to [Selection(one-or-more): detect; prevent] physical tampering or alteration of [Assignement: hardware components] within the system. Discussion Organizations can implement tamper detection and prevention at selected hardware components or implement tamper detection at some components and tamper prevention at other components. Detection and prevention activities can employ many types of anti-tamper technologies, including tamper-detection seals and anti-tamper coatings. Anti-tamper programs help to detect hardware alterations through counterfeiting and other supply chain-related risks. Assessment Objective [Assignement: anti-tamper technologies] are employed to [Selection(one-or-more): detect; prevent] physical tampering or alteration of [Assignement: hardware components] within the system. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control list of security safeguards to detect/prevent physical tampering or alteration of system hardware components system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-03(07) Physical Barriers	Control Limit access using physical barriers. Discussion Physical barriers include bollards, concrete slabs, jersey walls, and hydraulic active vehicle barriers. Assessment Objective physical barriers are used to limit access. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control list of physical barriers to limit access to the system system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities
PE-03(08) Access Control Vestibules	Control Employ access control vestibules at [Assignement: locations]. Discussion An access control vestibule is part of a physical access control system that typically provides a space between two sets of interlocking doors. Vestibules are designed to prevent unauthorized individuals from following authorized individuals into facilities with controlled access. This activity, also known as piggybacking or tailgating, results in unauthorized access to the facility. Interlocking door controllers can be used to limit the number of individuals who enter controlled access points and to provide containment areas while authorization for physical access is verified. Interlocking door controllers can be fully automated (i.e., controlling the opening and closing of the doors) or partially automated (i.e., using security guards to control the number of individuals entering the containment area). Assessment Objective access control vestibules are employed at [Assignement: locations]. Assessment Method Examine Physical and environmental protection policy procedures addressing physical access control list of access control vestibules and locations system security plan other relevant documents or records Interview Organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen
Quelle	Anforderung

3. Zugehörige Regulierungen

Regulierungen
Quelle	Regulierung

Verknüpfte Vorgänge

Verknüpfungen
Verknüpfungstyp	Vorgang
is blocked by	PE-03 Physical Access Control – Assessment Procedure
is blocked by	Physical Access Control

NIST -
https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final