PE-3 Physical access control
Requires physical access authorizations to be enforced at defined entry and exit points by verifying authorization before entry and controlling ingress and egress with defined mechanisms or guards, physical access audit
5
artefacts
1
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Physical access audit logs from badge or guard systems · Physical access / facilities
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Entry and exit point register showing the enforcement mechanism at each · Policy repository / GRC workspace
- Visitor escort procedure and completed visitor logs · Policy repository / GRC workspace
- Key and combination inventory with reissue records after defined events · Policy repository / GRC workspace
- Controls applied to publicly accessible areas within the facility · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Tailgating unaddressed, so an authorization check happens for only the first person through
- Combinations unchanged after staff with knowledge of them departed
- Access logs collected by a landlord and never obtained or reviewed by the organization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-2 Physical access authorizations · PE-4 Access control for transmission