+Physical Access Control
---+Physical Access Device Inventories
|
Physical Access Control
Description
Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Physical security policy
∙ Door locks and key management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Physical security policy
∙ Access log
∙ Visitor procedures
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ Physical security controls and technologies ensure that only authorized personnel are allowed access to secure areas.
▪ A facilities maintenance team, or similar function, manages the operation of automated physical and environmental protection controls.
▪ Physical security controls and technologies are configured to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Level 3 Well Defined
Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.
▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation and proximity badge access).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational physical security capability exists to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Level 4 Quantitatively Controlled
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
1. Ülevaade
| Pealkiri |
Standard |
|
Physical Access Device Inventories
|
Description
Mechanisms exist to maintain an accurate inventory of all physical access devices (e.g., RFID cards, access fobs and door keys).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Key and badge log (spreadsheet) with holder name
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Key/badge inventory with issuance and return records
∙ Periodic reconciliation of issued devices
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Physical access control system badge inventory
∙ Key management log or key cabinet (e.g., KeyWatcher)
∙ Annual reconciliation
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ PACS credential inventory reconciled with HR roster
∙ Electronic key management system (e.g., Traka, KeyWatcher)
∙ Quarterly reconciliation
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise PACS credential lifecycle management
∙ Electronic key management with audit trail
∙ Automated reconciliation against identity system
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).
▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.
▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation and proximity badge access).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to maintain an accurate inventory of all physical access devices (e.g., RFID cards, access fobs and door keys).
Level 4 Quantitatively Controlled
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
1.1 Viited
1.2 Tuvastatud nõuded
1.3 Seotud regulatsioonid
2. Tuvastatud nõuded
3. Seotud regulatsioonid
Regulatsioonid
| Allikas |
Regulatsioon |
|
EULAW
|
Artikkel 21 Pääsu reguleerimine
Artikkel 21
Finantssektori ettevõtjad töötavad pääsuhalduse õiguste reguleerimise osana välja ja dokumenteerivad põhimõtted, mis peavad hõlmama kõike järgmist, ning rakendavad neid:
a)
IKT-varadele juurdepääsu õiguste, sealhulgas kaugpääsu ja hädaolukorras pääsu õiguse andmine, lähtudes teadmisvajadusest, kasutusvajadusest ja minimaalõiguste printsiibist;
b)
ülesannete lahusus, et ära hoida põhjendamatu juurdepääs kriitilise tähtsusega andmetele või sellise pääsuõiguste kombinatsiooni tekkimine, mida võidakse kasutada kontrollist kõrvalehoidmiseks;
c)
säte kasutaja vastutuse kohta, millega piiratakse nii palju kui võimalik üldkontode ja jagatud kasutajakontode kasutamist ning tagatakse, et kasutajad on IKT-süsteemides tehtavate toimingute puhul alati tuvastatavad;
d)
säte IKT-varadele juurdepääsu piiramise kohta, millega nähakse ette kontrollid ja vahendid loata juurdepääsu ärahoidmiseks;
e)
kontohaldusmenetlused kasutaja- ja üldkontode, kaasa arvatud üldiste administraatorikontode pääsuõiguste andmiseks, muutmiseks või tühistamiseks, sealhulgas sätted kõige järgmise kohta:
i)
rollide ja vastutusvaldkondade määramine pääsuõiguste andmiseks, läbivaatamiseks ja tühistamiseks,
ii)
kõikidele IKT-süsteemidele eelis-, hädaolukorras või administraatori pääsu andmine kasutusvajaduse korral või vajaduspõhiselt,
iii)
pääsuõiguste tühistamine põhjendamatu viivituseta, kui töösuhe lõpeb või kui pääs ei ole enam vajalik,
iv)
pääsuõiguste ajakohastamine, kui on vaja teha muudatusi, ning kriitilise tähtsusega või olulisi funktsioone toetavate IKT-süsteemide puhul vähemalt kord kuue kuu jooksul ning kõigi muude IKT-süsteemide puhul vähemalt kord aastas;
f)
autentimismeetodid, sealhulgas kõik järgmine:
i)
autentimismeetodite kasutamine viisil, mis on vastavuses määruse (EL) 2022/2554 artikli 8 lõike 1 kohase liigitusega ja IKT-varade üldise riskiprofiiliga, ning võttes arvesse juhtivaid tavasid,
ii)
tugevate autentimismeetodite kasutamine finantssektori ettevõtja võrgule kaugpääsu, eelispääsu, kriitilise tähtsusega või olulisi funktsioone toetavatele IKT-varadele juurdepääsu või üldsusele kättesaadavatele IKT-varadele juurdepääsu andmisel kooskõlas juhtivate tavade ja meetoditega;
g)
füüsilise pääsu reguleerimise meetmed, sealhulgas
i)
selliste füüsiliste isikute identifitseerimine ja nende toimingute logimine, kellel on õigus siseneda finantssektori ettevõtja ruumidesse ja andmekeskustesse ning finantssektori ettevõtja kindlaks määratud tundlikele aladele, kus asuvad IKT- ja teabevarad,
ii)
kriitilise tähtsusega IKT-varade puhul füüsilise pääsu õiguse andmine üksnes volitatud isikutele kooskõlas teadmisvajaduse ja minimaalõiguste printsiibiga ning vajaduspõhiselt,
iii)
finantssektori ettevõtja ruumidesse ja andmekeskustesse ning finantssektori ettevõtja kindlaks määratud tundlikele aladele, kus asuvad IKT- ja teabevarad, füüsilise pääsu seire,
iv)
füüsilise pääsu õiguste läbivaatamine, et tagada tarbetute pääsuõiguste viivitamatu tühistamine.
Punkti e alapunkti i kohaldamisel määravad finantssektori ettevõtjad kindlaks säilitamistähtaja, võttes arvesse äri- ja infoturbe eesmärke, sündmuse logis registreerimise põhjust ja IKT-riski hindamise tulemusi.
Punkti e alapunkti ii kohaldamisel kasutavad finantssektori ettevõtjad IKT-süsteemidega seotud haldusülesannete täitmiseks võimaluse korral spetsiaalseid kontosid. Kui see on teostatav ja asjakohane, võtavad finantssektori ettevõtjad eelispääsu haldamiseks kasutusele automatiseeritud lahendused.
Punkti g alapunkti i kohaldamisel peavad identifitseerimine ja logimine olema vastavuses ruumide, andmekeskuste ja kindlaksmääratud tundlike alade ning seal tehtavate toimingute või asuvate IKT-süsteemide kriitilise tähtsusega.
Punkti g alapunkti iii kohaldamisel peab seire olema vastavuses määruse (EL) 2022/2554 artikli 8 lõike 1 kohase liigitusega ja juurdepääsetava ala kriitilise tähtsusega.
|
|
EULAW
|
Artikkel 32 Füüsiline ja keskkonnaturve
-
|
|
EULAW
|
Artikkel 33 Pääsu reguleerimine
Artikkel 33
Määruse (EL) 2022/2554 artikli 16 lõikes 1 osutatud finantssektori ettevõtjad töötavad välja ja dokumenteerivad loogilise ja füüsilise pääsu reguleerimise menetlused ja rakendavad neid ning tagavad nende menetluste järgimise, seire ja korrapärase läbivaatamise. Need menetlused peavad sisaldama sisaldavad järgmisi loogilise ja füüsilise pääsu reguleerimise elemente:
a)
finantssektori ettevõtja teabevaradele, IKT-varadele ja nendega toetatavatele funktsioonidele ning elutähtsatele tegevuskohtadele juurdepääsu õiguste, sealhulgas kaugpääsu ja hädaolukorras pääsu õiguste haldamine, lähtudes teadmisvajadusest, kasutusvajadusest ja minimaalõiguste printsiibist;
b)
kasutajate vastutus, millega tagatakse, et IKT-süsteemis toimingu teinud kasutaja on võimalik tuvastada;
c)
kontohaldusmenetlused kasutaja- ja üldkontode, sealhulgas üldiste administraatorikontode pääsuõiguste andmiseks, muutmiseks või tühistamiseks;
d)
autentimismeetodid, mis on vastavuses artikli 30 lõikes 1 osutatud liigitusega ja IKT-varade üldise riskiprofiiliga ning põhinevad juhtivatel tavadel;
e)
pääsuõiguste korrapärane läbivaatamine ja tühistamine, kui neid ei ole enam vaja.
Punkti c kohaldamisel võimaldab finantssektori ettevõtja kõikidele IKT-süsteemidele eelis-, hädaolukorras või administraatori pääsu kasutusvajaduse korral või vajaduspõhiselt ning see pääs logitakse kooskõlas artikli 34 lõike 1 punktiga f.
Punkti d kohaldamisel kasutavad finantssektori ettevõtjad oma võrgule kaugpääsu, eelispääsu ning kriitilise tähtsusega või olulisi funktsioone toetavatele üldsusele kättesaadavatele IKT-varadele juurdepääsu andmisel juhtivatel tavadel põhinevaid tugevaid autentimismeetodeid.
|
Lingitud teemad
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.
|