Assessment Objective

Determine if:

• a list of individuals with authorized access to the facility where the system resides is developed.
• a list of individuals with authorized access to the facility where the system resides is approved.
• a list of individuals with authorized access to the facility where the system resides is maintained.
• the facility access list is reviewed [Assignment: frequency].
• individuals from the facility access list are removed when access is no longer required.
• authorization credentials for facility access are issued.

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for physical access authorizations
• authorized personnel access list
• physical access list reviews
• physical access termination records
• authorization credentials
• system security plan
• other relevant documents or records

Interview

• personnel with physical access authorization responsibilities
• personnel with physical access to the facility where the system resides
• personnel with information security responsibilities

Test

• processes for physical access authorizations
• mechanisms for supporting or implementing physical access authorizations

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final