PE-3 Physical Access Control

a. Enforce physical access authorizations at organization-defined entry and exit points to the facility where the system resides by: 1. Verifying individual access authorizations before granting access to the facility; and 2. Controlling ingress and egress to the facility using Selection (one or more): [organization-defined physical access control systems or devices; guards]; b. Maintain physical access audit logs for organization-defined entry or exit points; c. Control access to areas within the facility designated as publicly accessible by implementing the following controls: organization-defined physical access controls; d. Escort visitors and control visitor activity organization-defined circumstances requiring visitor escorts and control of visitor activity; e. Secure keys, combinations, and other physical access devices; f. Inventory organization-defined physical access devices every organization-defined frequency; and g. Change combinations and keys organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Source: NIST SP 800-53 Rev 5, PE-3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.

Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.