PE-2 Physical access authorizations
Requires a list of individuals authorized to enter the facility housing the system to be developed, approved and maintained, access credentials to be issued, the list to be reviewed at a defined frequency, and individual
4
artefacts
2
held by a system
2
at each review
easy
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Approved facility access list with approval evidence · Physical access / facilities
- Reconciliation between the access list and the leaver process · Physical access / facilities
periodic reviewEvidence produced at each review
- Credential issue records tied to individuals on that list · Physical access / facilities
- Review records at the defined frequency with removals actioned · Physical access / facilities
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Physical access / facilities. Badge system access logs and visitor register exports; facilities maintenance tickets.
Common gaps auditors find
- Leavers keep working badges because access removal is not part of offboarding
- List reviewed but exceptions never removed from the badge system
- Contractor and vendor access granted outside the approved list
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-1 Policy and procedures for physical and environmental protection · PE-3 Physical access control