Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• PES-08_A01 physical access controls to control access to areas within the facility designated as publicly accessible are defined.
  Assessment rigor: 1
  Origin: 53A_R5_PE-03_ODP[05]
• PES-08_A02 physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.
  Assessment rigor: 1
  Origin: 53A_R5_PE-03a.01 171A_R3_A.03.10.07.a.02
• PES-08_A03 entry and exit points to the facility in which the system resides are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[01]
• PES-08_A04 entry or exit points for which physical access logs are maintained are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[04]
• PES-08_A05 physical access devices are identified.
  Assessment rigor: 1
  Origin: 171A_3.10.5[a] 53A_R5_PE-03_ODP[02] 53A_R5_PE-03_ODP[03]
• PES-08_A06 physical access devices are controlled.
  Assessment rigor: 1
  Origin: 171A_3.10.5[b]
• PES-08_A07 physical access devices are managed.
  Assessment rigor: 1
  Origin: 171A_3.10.5[c]
• PES-08_A08 circumstances requiring visitor escorts and control of visitor activity are defined.
  Defined parameters: in all circumstances within the restricted access area where the system resides
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[06]
• PES-08_A09 physical access devices to be inventoried are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[07]
• PES-08_A10 frequency at which to inventory physical access devices is defined.
  Defined parameters: at least annually or earlier as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[08]
• PES-08_A11 frequency at which to change combinations is defined.
  Defined parameters: as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[09]
• PES-08_A12 frequency at which to change keys is defined.
  Defined parameters: as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03_ODP[10]
• PES-08_A13 physical access authorizations are enforced at entry and exit points by controlling ingress and egress to the facility.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03a.02
• PES-08_A14 physical access event logs are maintained for entry or exit points.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03b.
• PES-08_A15 access to areas within the facility designated as publicly accessible are maintained by implementing physical access controls.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03c.
• PES-08_A16 visitors are escorted.
  Assessment rigor: 1
  Origin: 53A_R5_PE-03d.[01]
• PES-08_A17 visitor activity is controlled circumstances.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03d.[02]
• PES-08_A18 physical access devices are inventoried frequently.
  Defined parameters: at least annually or earlier as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03f.
• PES-08_A19 combinations are changed frequently, when combinations are compromised or when individuals possessing the combinations are transferred or terminated.
  Defined parameters: as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03g.[01]
• PES-08_A20 keys are changed frequency, when keys are lost or when individuals possessing the keys are transferred or terminated.
  Defined parameters: as required by a security relevant event
  Assessment rigor: 3
  Origin: 53A_R5_PE-03g.[02]
• PES-08_A21 the frequency at which to perform security checks at the physical perimeter of the facility or system for exfiltration of information or removal of system components is defined.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03(02)_ODP
• PES-08_A22 security checks are performed C at the physical perimeter of the facility or system for exfiltration of information or removal of system components.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03(02)
• PES-08_A23 physical access points to the facility where the system resides are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03(03)_ODP
• PES-08_A24 guards are employed to control physical access points to the facility where the system resides 24 hours per day, 7 days per week.
  Assessment rigor: 3
  Origin: 53A_R5_PE-03(03)
• PES-08_A25 physical access restrictions associated with changes to the system are enforced.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.04.05[03]
• PES-08_A26 keys, combinations, and other physical access devices are secured.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.10.07.d 53A_R5_PE-03e.[01] 53A_R5_PE-03e.[02] 53A_R5_PE-03e.[03]

Gekoppelde issues

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.