13.3 Perimeter and physical access control

Requirement

For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities shall prevent and monitor unauthorised physical access, damage and interference to their network and information systems.

Guidance

• Implement perimeter physical access control, where relevant (109), taking into account the measures for protection against physical and environmental threats (section 13.2).
• Ensure that physical access control is integrated with logical and network access control, in line with human resources security procedures (section 10.1) to support the detection of irregular activities and enhance overall organisational security.

Examples of evidence

• Documented policy for physical security measures, including a description of facilities and network and information systems in scope.

Requirement

For that purpose, the relevant entities shall: (a) on the basis of the risk assessment carried out pursuant to point 2.1, lay down and use security perimeters to protect areas where network and information systems and other associated assets are located; (b) protect the areas referred to in point (a) by appropriate entry controls and access points; (c) design and implement physical security for offices, rooms and facilities, (d) continuously monitor their premises for unauthorised physical access.

Guidance

• In the risk assessment, consider risks associated with unauthorised physical access to, damage to and interference with network and information systems.
• Based on the results of the risk assessment, determine high-criticality assets and the impact of their being compromised. This will help in identifying the perimeter for such assets.
• Prevent unauthorised physical access to facilities and set up adequate measures.
  • Physical access control measures designed to protect the entity as a whole will also protect individual assets.
  • Consider introducing further specific access control measures for specific assets or facilities.
• Consider physical security measures (indicative, non-exhaustive list):
  • physical access controls such as key cards, biometric scanners, locks and security personnel to restrict access to high-criticality areas,
  • electronic control of entry, with an audit trail,
  • segmentation of spaces or creation of zones according to authorization levels and their contents,
  • CCTV cameras and monitoring systems to continuously observe sensitive areas,
  • fencing, barriers and security patrols for securing physical perimeters,
  • guards and/or alarms to monitor every physical access point to the facility where the information system resides, 24 hours per day, seven days per week.
• Develop and enforce procedures for granting, reviewing and revoking physical access rights (section 11.2).
  • Identify a designated official within the entity to review and approve the list of personnel with authorized physical access.
  • Maintain a list of personnel with authorized access to facilities, and their authorization levels.

Examples of evidence

• Risk assessment results
• Existence of physical security measures
• Procedures for granting, reviewing and revoking physical access rights in accordance with point 11.2 in the Annex to the regulation.

Requirement

The relevant entities shall test, review and, where appropriate, update the physical access control measures on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Review physical access lists.
• Employ intrusion tests that include, where applicable, unannounced attempts to bypass or circumvent measures associated with physical access points to the facility.
• At the physical boundary of the facility or network and information system, perform security checks for unauthorised exfiltration of information or removal of information system components.

Examples of evidence

• Periodic simulations and awareness-raising activities to assess the readiness of personnel and the adequacy of the procedures for physical access control.
• Schedule and results of tests and security checks.
• Up-to-date list of personnel with authorised physical access to facilities.

Tips: guidance

• Enforce authorisation for physical access to network and information systems in addition to the physical access controls for the facility.
• Remove individuals from the facility access list when their access is no longer required.
• Document procedures for emergencies.
• Log and monitor personnel physical access (entry and exit) through an entry control system.
• Authenticate visitors before authorizing access to the facility. Escort visitors in accordance with security policies and procedures. Maintain records of visitors’ access to the facility.
• Employ automated mechanisms to facilitate the maintenance and review of visitor access records.
• Make sure that employees are aware of the existence of a secure area on a need-to-know basis.
• Define and communicate to personnel an intruder response process or emergency procedures.
• Communicate physical access control measures to employees.
• Separate facilities managed by the entity from those managed by third parties.
• Employ automated mechanisms to recognize types of intrusions and initiate defined response actions.
• Employ video surveillance of operational areas and retain video recordings for a defined period, in accordance with the GDPR.
• Keep physical access records as dictated by applicable regulations or based on an entity-defined period in accordance with the entity’s policy. Keep and store physical access records in case of an audit or investigation.
• Take heed of risk-assessment results before doing anything with damaged devices containing sensitive data.

Tips: examples of evidence

• Perimeter incident response procedures in place.
• Personnel clearly displaying their ID.