Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- PES-08_A01 physical access controls to control access to areas within the facility designated as publicly accessible are defined.
Assessment rigor: 1
Origin: 53A_R5_PE-03_ODP[05] - PES-08_A02 physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.
Assessment rigor: 1
Origin: 53A_R5_PE-03a.01 171A_R3_A.03.10.07.a.02 - PES-08_A03 entry and exit points to the facility in which the system resides are defined.
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[01] - PES-08_A04 entry or exit points for which physical access logs are maintained are defined.
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[04] - PES-08_A05 physical access devices are identified.
Assessment rigor: 1
Origin: 171A_3.10.5[a] 53A_R5_PE-03_ODP[02] 53A_R5_PE-03_ODP[03] - PES-08_A06 physical access devices are controlled.
Assessment rigor: 1
Origin: 171A_3.10.5[b] - PES-08_A07 physical access devices are managed.
Assessment rigor: 1
Origin: 171A_3.10.5[c] - PES-08_A08 circumstances requiring visitor escorts and control of visitor activity are defined.
Defined parameters: in all circumstances within the restricted access area where the system resides
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[06] - PES-08_A09 physical access devices to be inventoried are defined.
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[07] - PES-08_A10 frequency at which to inventory physical access devices is defined.
Defined parameters: at least annually or earlier as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[08] - PES-08_A11 frequency at which to change combinations is defined.
Defined parameters: as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[09] - PES-08_A12 frequency at which to change keys is defined.
Defined parameters: as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03_ODP[10] - PES-08_A13 physical access authorizations are enforced at entry and exit points by controlling ingress and egress to the facility.
Assessment rigor: 3
Origin: 53A_R5_PE-03a.02 - PES-08_A14 physical access event logs are maintained for entry or exit points.
Assessment rigor: 3
Origin: 53A_R5_PE-03b. - PES-08_A15 access to areas within the facility designated as publicly accessible are maintained by implementing physical access controls.
Assessment rigor: 3
Origin: 53A_R5_PE-03c. - PES-08_A16 visitors are escorted.
Assessment rigor: 1
Origin: 53A_R5_PE-03d.[01] - PES-08_A17 visitor activity is controlled circumstances.
Assessment rigor: 3
Origin: 53A_R5_PE-03d.[02] - PES-08_A18 physical access devices are inventoried frequently.
Defined parameters: at least annually or earlier as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03f. - PES-08_A19 combinations are changed frequently, when combinations are compromised or when individuals possessing the combinations are transferred or terminated.
Defined parameters: as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03g.[01] - PES-08_A20 keys are changed frequency, when keys are lost or when individuals possessing the keys are transferred or terminated.
Defined parameters: as required by a security relevant event
Assessment rigor: 3
Origin: 53A_R5_PE-03g.[02] - PES-08_A21 the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined.
Assessment rigor: 3
Origin: 53A_R5_PE-03(02)_ODP - PES-08_A22 security checks are performed C at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
Assessment rigor: 3
Origin: 53A_R5_PE-03(02) - PES-08_A23 physical access points to the facility where the system resides are defined.
Assessment rigor: 3
Origin: 53A_R5_PE-03(03)_ODP - PES-08_A24 guards are employed to control physical access points to the facility where the system resides 24 hours per day, 7 days per week.
Assessment rigor: 3
Origin: 53A_R5_PE-03(03) - PES-08_A25 physical access restrictions associated with changes to the system are enforced.
Assessment rigor: 2
Origin: 171A_R3_A.03.04.05[03] - PES-08_A26 keys, combinations, and other physical access devices are secured.
Assessment rigor: 2
Origin: 171A_R3_A.03.10.07.d 53A_R5_PE-03e.[01] 53A_R5_PE-03e.[02] 53A_R5_PE-03e.[03]
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | Physical Access Control |
- Secure Controls Framework -
The Secure Controls Framework® (SCF)
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.