Assessment Objective
Determine if:
- PE-02a.
- PE-02a.[01] a list of individuals with authorized access to the facility where the system resides has been developed;
- PE-02a.[02] the list of individuals with authorized access to the facility where the system resides has been approved;
- PE-02a.[03] the list of individuals with authorized access to the facility where the system resides has been maintained;
- PE-02b. authorization credentials are issued for facility access;
- PE-02c. the access list detailing authorized facility access by individuals is reviewed [Assignment: frequency];
- PE-02d. individuals are removed from the facility access list when access is no longer required.
Assessment Methods
Examine
- Physical and environmental protection policy
- procedures addressing physical access authorizations
- authorized personnel access list
- authorization credentials
- physical access list reviews
- physical access termination records and associated documentation
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with physical access authorization responsibilities
- organizational personnel with physical access to system facility
- organizational personnel with information security responsibilities
Test
- Organizational processes for physical access authorizations
- mechanisms supporting and/or implementing physical access authorizations
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | PE-02 [M] Physical Access Authorizations |