+Physical Access Control
---+Physical Access Device Inventories
|
Physical Access Control
Description
Physical access control mechanisms exist to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Physical security policy
∙ Door locks and key management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Physical security policy
∙ Access log
∙ Visitor procedures
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Staffed lobby (receptionist)
∙ Physical security guards
∙ Verify individual access authorizations before granting access to the facility.
∙ Control entry to the facility containing the system using physical access devices and/or guards.
∙ Control access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk.
∙ Secure keys, combinations and other physical access devices.
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Physical & Environmental Security (PES) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Physical security / facilities management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Physical security / facilities management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Physical security controls and technologies primarily focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ Physical security controls and technologies ensure that only authorized personnel are allowed access to secure areas.
▪ A facilities maintenance team, or similar function, manages the operation of automated physical and environmental protection controls.
▪ Physical security controls and technologies are configured to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Level 3 Well Defined
Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.
▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation and proximity badge access).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational physical security capability exists to enforce physical access authorizations for all physical access points (including designated entry/exit points) to facilities (excluding those areas within the facility officially designated as publicly accessible).
Level 4 Quantitatively Controlled
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
1. Ħarsa ġenerali
| Titlu |
Standard |
|
Physical Access Device Inventories
|
Description
Mechanisms exist to maintain an accurate inventory of all physical access devices (e.g., RFID cards, access fobs and door keys).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Key and badge log (spreadsheet) with holder name
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Key/badge inventory with issuance and return records
∙ Periodic reconciliation of issued devices
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Physical access control system badge inventory
∙ Key management log or key cabinet (e.g., KeyWatcher)
∙ Annual reconciliation
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ PACS credential inventory reconciled with HR roster
∙ Electronic key management system (e.g., Traka, KeyWatcher)
∙ Quarterly reconciliation
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise PACS credential lifecycle management
∙ Electronic key management with audit trail
∙ Automated reconciliation against identity system
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Physical & Environmental Security (PES) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with PES domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Physical security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Physical security controls are primarily administrative in nature (e.g., policies & standards), focusing on protecting High Value Assets (HVAs).
▪ IT and/or cybersecurity personnel implement appropriate physical security practices to protect the confidentiality, integrity, availability and safety of the organization's technology assets and data.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Physical & Environmental Security (PES) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PES domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PES domain capabilities are well-documented and kept current by process owners.
▪ A facilities management team, or similar function, is appropriately staffed and supported to implement and maintain NET domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of physical and environmental security operations (e.g., facility management solution, visitor log management automation and proximity badge access).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PES domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to maintain an accurate inventory of all physical access devices (e.g., RFID cards, access fobs and door keys).
Level 4 Quantitatively Controlled
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Physical & Environmental Security (PES) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
|
EULAW
|
Artikolu 21 Kontroll tal-aċċess
Artikolu 21
Bħala parti mill-kontroll tagħhom tad-drittijiet ta’ ġestjoni tal-aċċess, l-entitajiet finanzjarji għandhom jiżviluppaw, jiddokumentaw u jimplimentaw politika li jkun fiha dawn kollha li ġejjin:
(a)
l-assenjazzjoni tad-drittijiet ta’ aċċess għall-assi tal-ICT abbażi tal-prinċipji tal-ħtieġa ta’ tagħrif, tal-ħtieġa ta’ użu u tal-anqas privileġġ, inkluż għal aċċess mill-bogħod u ta’ emerġenza;
(b)
is-segregazzjoni tad-dmirijiet imfassla biex jipprevjenu aċċess mhux iġġustifikat għal data kritika jew biex jipprevjenu l-allokazzjoni ta’ kombinazzjonijiet ta’ drittijiet ta’ aċċess li jistgħu jintużaw biex jiġu evitati l-kontrolli;
(c)
dispożizzjoni dwar l-akkontabilità tal-utent, billi jiġi llimitat sa fejn ikun possibbli l-użu ta’ kontijiet tal-utenti ġeneriċi u kondiviżi u jiġi żgurat li l-utenti jkunu identifikabbli għall-azzjonijiet imwettqa fis-sistemi tal-ICT f’kull ħin;
(d)
dispożizzjoni dwar ir-restrizzjonijiet tal-aċċess għall-assi tal-ICT, li tistabbilixxi kontrolli u għodod biex jiġi pprevenut aċċess mhux awtorizzat;
(e)
proċeduri ta’ ġestjoni tal-kontijiet għall-għoti, għat-tibdil jew għar-revoka tad-drittijiet ta’ aċċess għall-kontijiet tal-utenti u l-kontijiet ġeneriċi, inklużi l-kontijiet tal-amministraturi ġeneriċi, u wkoll dispożizzjoni dwar dawn kollha li ġejjin:
(i)
l-assenjazzjoni tar-rwoli u tar-responsabbiltajiet għall-għoti, għar-rieżami u għar-revoka tad-drittijiet ta’ aċċess;
(ii)
l-assenjazzjoni ta’ aċċess privileġġat, ta’ emerġenza u ta’ amministratur fuq bażi ta’ ħtieġa ta’ użu jew fuq bażi ad hoc għas-sistemi kollha tal-ICT;
(iii)
l-irtirar tad-drittijiet ta’ aċċess mingħajr dewmien żejjed mat-terminazzjoni tal-impjieg jew meta l-aċċess ma jkunx għadu meħtieġ;
(iv)
aġġornament tad-drittijiet ta’ aċċess fejn ikunu meħtieġa tibdiliet u mill-anqas darba fis-sena għas-sistemi kollha tal-ICT, għajr għas-sistemi tal-ICT li jappoġġaw funzjonijiet kritiċi jew importanti u mill-anqas kull 6 xhur għas-sistemi tal-ICT li jappoġġaw funzjonijiet kritiċi jew importanti;
(f)
metodi ta’ awtentikazzjoni, inklużi dawn kollha li ġejjin:
(i)
l-użu ta’ metodi ta’ awtentikazzjoni proporzjonati għall-klassifikazzjoni stabbilita f’konformità mal-Artikolu 8(1) tar-Regolament (UE) 2022/2554 u għall-profil tar-riskju ġenerali tal-assi tal-ICT u filwaqt li jitqiesu prattiki ewlenin;
(ii)
l-użu ta’ metodi ta’ awtentikazzjoni b’saħħithom f’konformità ma’ prattiki u tekniki ewlenin għall-aċċess mill-bogħod għan-network tal-entità finanzjarja, għal aċċess privileġġat, għal aċċess għall-assi tal-ICT li jappoġġaw funzjonijiet kritiċi jew importanti jew assi tal-ICT li huma aċċessibbli għall-pubbliku;
(g)
miżuri ta’ kontroll għall-aċċess fiżiku li jinkludu:
(i)
l-identifikazzjoni u r-reġistrazzjoni ta’ persuni fiżiċi li huma awtorizzati jaċċessaw il-bini, iċ-ċentri tad-data u ż-żoni ddeżinjati sensittivi identifikati mill-entità finanzjarja fejn hemm l-assi tal-ICT u tal-informazzjoni;
(ii)
l-għoti ta’ drittijiet ta’ aċċess fiżiku għal assi kritiċi tal-ICT lil persuni awtorizzati biss, f’konformità mal-prinċipji tal-ħtieġa ta’ tagħrif u tal-anqas privileġġ, u fuq bażi ad hoc;
(iii)
il-monitoraġġ tal-aċċess fiżiku għall-bini, għaċ-ċentri tad-data u għal żoni ddeżinjati sensittivi identifikati mill-entità finanzjarja fejn ikun hemm l-assi tal-ICT u tal-informazzjoni jew it-tnejn li huma;
(iv)
ir-rieżami tad-drittijiet ta’ aċċess fiżiku biex jiġi żgurat li d-drittijiet ta’ aċċess mhux meħtieġa jiġu rrevokati minnufih.
Għall-finijiet tal-punt (e)(i), l-entitajiet finanzjarji għandhom jistabbilixxu l-perjodu ta’ żamma filwaqt li jqisu l-objettivi tas-sigurtà tan-negozju u tal-informazzjoni, ir-raġunijiet għar-reġistrazzjoni tal-avveniment fir-reġistri u r-riżultati tal-valutazzjoni tar-riskju tal-ICT.
Għall-finijiet tal-punt (e)(ii), l-entitajiet finanzjarji għandhom, meta possibbli, jużaw kontijiet iddedikati għat-twettiq ta’ kompiti amministrattivi fuq is-sistemi tal-ICT. Meta jkun fattibbli u xieraq, l-entitajiet finanzjarji għandhom jużaw soluzzjonijiet awtomatizzati għall-ġestjoni tal-aċċess għall-privileġġ.
Għall-finijiet tal-punt (g)(i), l-identifikazzjoni u r-reġistrazzjoni għandhom ikunu proporzjonati mal-importanza tal-bini, taċ-ċentri tad-data, taż-żoni ddeżinjati sensittivi u mal-kritikalità tal-operazzjonijiet jew tas-sistemi tal-ICT li jinsabu fihom.
Għall-finijiet tal-punt (g)(iii), il-monitoraġġ għandu jkun proporzjonat mal-klassifikazzjoni stabbilita f’konformità mal-Artikolu 8(1) tar-Regolament (UE) 2022/2554 u għall-kritikalità taż-żona aċċessata.
|
|
EULAW
|
Artikolu 32 Sigurtà fiżika u ambjentali
-
|
|
EULAW
|
Artikolu 33 Kontroll tal-Aċċess
Artikolu 33
L-entitajiet finanzjarji msemmija fl-Artikolu 16(1) tar-Regolament (UE) 2022/2554 għandhom jiżviluppaw, jiddokumentaw u jimplimentaw proċeduri għall-kontroll loġiku u fiżiku tal-aċċess għandhom jinfurzaw, jimmonitorjaw u jirrieżaminaw perjodikament dawk il-proċeduri. Dawk il-proċeduri għandu jkun fihom l-elementi ta’ kontroll loġiku u fiżiku tal-aċċess li ġejjin:
(a)
id-drittijiet ta’ aċċess għal assi tal-informazzjoni, għal assi tal-ICT u għall-funzjonijiet appoġġati tagħhom, u għal postijiet kritiċi ta’ operazzjoni tal-entità finanzjarja, huma ġestiti fuq bażi ta’ ħtieġa ta’ tagħrif, ħtieġa ta’ użu u tal-anqas privileġġi, inkluż għal aċċess mill-bogħod u ta’ emerġenza;
(b)
l-akkontabilità tal-utent, li tiżgura li l-utenti jkunu jistgħu jiġu identifikati għall-azzjonijiet imwettqa fis-sistemi tal-ICT;
(c)
proċeduri ta’ ġestjoni tal-kontijiet għall-għoti, it-tibdil jew ir-revoka tad-drittijiet ta’ aċċess għall-kontijiet tal-utenti u l-kontijiet ġeneriċi, inklużi l-kontijiet ta’ amministraturi ġeneriċi;
(d)
metodi ta’ awtentikazzjoni li huma proporzjonati għall-klassifikazzjoni msemmija fl-Artikolu 30(1) u għall-profil tar-riskju ġenerali tal-assi tal-ICT, u li huma bbażati fuq prattiki ewlenin;
(e)
id-drittijiet ta’ aċċess jiġu rrieżaminati perjodikament u jiġu rtirati meta ma jibqgħux meħtieġa.
Għall-finijiet tal-punt (c), l-entità finanzjarja għandha tassenja aċċess privileġġat, ta’ emerġenza u ta’ amministratur fuq bażi tal-ħtieġa tal-użu jew fuq bażi ad hoc għas-sistemi kollha tal-ICT, u għandha tiġi rreġistrata f’konformità mal-Artikolu 34, l-ewwel paragrafu, il-punt (f).
Għall-finijiet tal-punt (d), l-entitajiet finanzjarji għandhom jużaw metodi ta’ awtentikazzjoni b’saħħithom li huma bbażati fuq prattiki ewlenin għall-aċċess mill-bogħod għan-network tal-entitajiet finanzjarji, għall-aċċess privileġġat, u għall-aċċess għall-assi tal-ICT li jappoġġaw funzjonijiet kritiċi jew importanti li huma disponibbli għall-pubbliku.
|
Kwistjonijiet marbuta
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.
|