PS-04 Physical site access control
Control entry at every access point using an access control system whose documented rules grant least privilege authorisations, revoke unused rights after two and six months, enforce two factor authentication for areas h
4
artefacts
2
held by a system
0
at each review
easy
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Badge system export showing authorisation holders per security area · Physical access / facilities
- Door reader event log for a sampled high security room · Physical access / facilities
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Report of automatically revoked credentials with the recorded inactivity dates · Policy repository / GRC workspace
- Visitor register with escort names and pass return times · Policy repository / GRC workspace
First move
Automate the pull from your Physical access / facilities. Badge system access logs and visitor register exports; facilities maintenance tickets.
Common gaps auditors find
- Dormant contractor badges still active well past the stated inactivity limit
- Two factor reader on the machine room door bypassed through an adjacent office door
- Visitors recorded at reception yet not tracked by the badge system inside the building
- No periodic reconciliation of badge holders against current job roles
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPS-03 Perimeter Protection · PS-05 Protection from fire and smoke