13.3.3 The relevant entities shall test, review and, where appropriate, update the physical access control …

Requirement

The relevant entities shall test, review and, where appropriate, update the physical access control measures on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Review physical access lists.
• Employ intrusion tests that include, where applicable, unannounced attempts to bypass or circumvent measures associated with physical access points to the facility.
• At the physical boundary of the facility or network and information system, perform security checks for unauthorised exfiltration of information or removal of information system components.

Examples of evidence

• Periodic simulations and awareness-raising activities to assess the readiness of personnel and the adequacy of the procedures for physical access control.
• Schedule and results of tests and security checks.
• Up-to-date list of personnel with authorised physical access to facilities.

Tips: guidance

• Enforce authorisation for physical access to network and information systems in addition to the physical access controls for the facility.
• Remove individuals from the facility access list when their access is no longer required.
• Document procedures for emergencies.
• Log and monitor personnel physical access (entry and exit) through an entry control system.
• Authenticate visitors before authorizing access to the facility. Escort visitors in accordance with security policies and procedures. Maintain records of visitors’ access to the facility.
• Employ automated mechanisms to facilitate the maintenance and review of visitor access records.
• Make sure that employees are aware of the existence of a secure area on a need-to-know basis.
• Define and communicate to personnel an intruder response process or emergency procedures.
• Communicate physical access control measures to employees.
• Separate facilities managed by the entity from those managed by third parties.
• Employ automated mechanisms to recognize types of intrusions and initiate defined response actions.
• Employ video surveillance of operational areas and retain video recordings for a defined period, in accordance with the GDPR.
• Keep physical access records as dictated by applicable regulations or based on an entity-defined period in accordance with the entity’s policy. Keep and store physical access records in case of an audit or investigation.
• Take heed of risk-assessment results before doing anything with damaged devices containing sensitive data.

Tips: examples of evidence

• Perimeter incident response procedures in place.
• Personnel clearly displaying their ID.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -