DCS-09 Secure Area Authorization
Admit only authorised people to secure areas, restrict and monitor every entry and exit point with physical access mechanisms, and retain the access records for the period the organisation has set.
4
artefacts
2
held by a system
2
at each review
easy
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Physical access control configuration covering ingress and egress · Physical access / facilities
- Access logs retained for the defined period · Physical access / facilities
periodic reviewEvidence produced at each review
- The authorised access list per secure area and its review records · Physical access / facilities
- Records of access reviews and removals · Physical access / facilities
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Physical access / facilities. Badge system access logs and visitor register exports; facilities maintenance tickets.
Common gaps auditors find
- Egress not controlled or monitored, only entry
- Access list never reviewed, so leavers retain badge rights
- Retention period undefined, so logs are purged inconsistently
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDCS-08 Equipment Identification · DCS-10 Surveillance System