03.10 Physical Protection

Statement

• a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides.

• b. Issue authorization credentials for facility access.

• c. Review the facility access list {{ insert: param, A.03.10.01.ODP.01 }}.

• d. Remove individuals from the facility access list when access is no longer required.

Guidance

A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include identification badges, identification cards, and smart cards. Organizations determine the strength of the authorization credentials consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.

Assessment objective

a list of individuals with authorized access to the facility where the system resides is developed.

Assessment objective

a list of individuals with authorized access to the facility where the system resides is approved.

Assessment objective

a list of individuals with authorized access to the facility where the system resides is maintained.

Assessment objective

the facility access list is reviewed {{ insert: param, A.03.10.01.ODP.01 }}.

Assessment objective

individuals from the facility access list are removed when access is no longer required.

Assessment objective

authorization credentials for facility access are issued.

Assessment method

• physical protection policy and procedures procedures for physical access authorizations authorized personnel access list physical access list reviews physical access termination records authorization credentials system security plan other relevant documents or records

Assessment method

• personnel with physical access authorization responsibilities personnel with physical access to the facility where the system resides personnel with information security responsibilities

Assessment method

• processes for physical access authorizations mechanisms for supporting or implementing physical access authorizations

Statement

• a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.

• b. Review physical access logs {{ insert: param, A.03.10.02.ODP.01 }} and upon occurrence of {{ insert: param, A.03.10.02.ODP.02 }}.

Guidance

A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help to identify suspicious activities, anomalous events, or potential threats. The reviews can be supported by audit logging controls if the access logs are part of an automated system. Incident response capabilities include investigations of physical security incidents and responses to those incidents. Incidents include security violations or suspicious physical access activities, such as access outside of normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access.

Assessment objective

physical access to the facility where the system resides is monitored to detect physical security incidents.

Assessment objective

physical security incidents are responded to.

Assessment objective

physical access logs are reviewed {{ insert: param, A.03.10.02.ODP.01 }} .

Assessment objective

physical access logs are reviewed upon occurrence of {{ insert: param, A.03.10.02.ODP.02 }}.

Assessment method

• physical protection policy and procedures procedures for physical access monitoring physical access logs or records physical access monitoring records physical access log reviews system security plan other relevant documents or records

Assessment method

• personnel with physical access monitoring responsibilities personnel with incident response responsibilities personnel with information security responsibilities

Assessment method

• processes for monitoring physical access mechanisms for supporting or implementing physical access monitoring mechanisms for supporting or implementing the review of physical access logs

Statement

• a. Determine alternate work sites allowed for use by employees.

• b. Employ the following security requirements at alternate work sites: {{ insert: param, A.03.10.06.ODP.01 }}.

Guidance

Alternate work sites include the private residences of employees or other facilities designated by the organization. Alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different security requirements for specific alternate work sites or types of sites, depending on the work-related activities conducted at the sites. Assessing the effectiveness of the requirements and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.

Assessment objective

alternate work sites allowed for use by employees are determined.

Assessment objective

the following security requirements are employed at alternate work sites: {{ insert: param, A.03.10.06.ODP.01 }}.

Assessment method

• physical protection policy and procedures procedures for alternate work sites for personnel list of security requirements for alternate work sites assessments of security requirements at alternate work sites system security plan other relevant documents or records

Assessment method

• personnel approving the use of alternate work sites personnel using alternate work sites personnel assessing security requirements at alternate work sites personnel with information security responsibilities

Assessment method

• processes for security at alternate work sites mechanisms for supporting alternate work sites security requirements employed at alternate work sites means of communication between personnel at alternate work sites and security personnel

Statement

• a. Enforce physical access authorizations at entry and exit points to the facility where the system resides by:

  • 01. Verifying individual physical access authorizations before granting access to the facility and

  • 02. Controlling ingress and egress with physical access control systems, devices, or guards.

• b. Maintain physical access audit logs for entry or exit points.

• c. Escort visitors, and control visitor activity.

• d. Secure keys, combinations, and other physical access devices.

• e. Control physical access to output devices to prevent unauthorized individuals from obtaining access to CUI.

Guidance

This requirement addresses physical locations containing systems or system components that process, store, or transmit CUI. Organizations determine the types of guards needed, including professional security staff or administrative staff. Physical access devices include keys, locks, combinations, biometric readers, and card readers. Physical access control systems comply with applicable laws, Executive Orders, directives, policies, regulations, standards, and guidelines. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural, automated, or some combination thereof. Physical access points can include exterior access points, interior access points to systems that require supplemental access controls, or both. Physical access control applies to employees and visitors. Individuals with permanent physical access authorizations are not considered visitors. Controlling physical access to output devices includes placing output devices in locked rooms or other secured areas with keypad or card reader access controls and only allowing access to authorized individuals, placing output devices in locations that can be monitored by personnel, installing monitor or screen filters, and using headphones. Examples of output devices include monitors, printers, scanners, facsimile machines, audio devices, and copiers.

Assessment objective

physical access authorizations are enforced at entry and exit points to the facility where the system resides by verifying individual physical access authorizations before granting access.

Assessment objective

physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.

Assessment objective

physical access audit logs for entry or exit points are maintained.

Assessment objective

visitors are escorted.

Assessment objective

visitor activity is controlled.

Assessment objective

physical access to output devices is controlled to prevent unauthorized individuals from obtaining access to CUI.

Assessment objective

keys, combinations, and other physical access devices are secured.

Assessment method

• physical protection policy and procedures procedures for physical access control physical access control logs or records inventory records of physical access control devices system entry and exit points records of key and lock combination changes storage locations for physical access control devices physical access control devices list of security safeguards controlling access to designated publicly accessible areas within facility system security plan other relevant documents or records

Assessment method

• personnel with physical access control responsibilities personnel with information security responsibilities

Assessment method

• processes for physical access control mechanisms for supporting or implementing physical access control physical access control devices

Statement

Control physical access to system distribution and transmission lines within organizational facilities.

Guidance

Safeguarding measures applied to system distribution and transmission lines prevent accidental damage, disruption, and physical tampering. Such measures may also be necessary to prevent eavesdropping or the modification of unencrypted transmissions. Safeguarding measures used to control physical access to system distribution and transmission lines include disconnected or locked spare jacks, locked wiring closets, cabling protection with conduit or cable trays, and wiretapping sensors.

Assessment objective

physical access to system distribution and transmission lines within organizational facilities is controlled.

Assessment method

• physical protection policy and procedures procedures for access control for transmission mediums system design documentation facility communications and wiring diagrams list of physical security safeguards applied to system distribution and transmission lines procedures for access control for display medium facility layout of system components list of output devices and associated outputs that require physical access controls actual displays from system components physical access control logs or records for areas containing output devices and related outputs system security plan other relevant documents or records

Assessment method

• personnel with physical access control responsibilities personnel with information security responsibilities

Assessment method

• processes for access control for distribution and transmission lines mechanisms for supporting or implementing access control for distribution and transmission lines processes for access control to output devices mechanisms for supporting or implementing access control for output devices