PE-6 Monitoring physical access
Requires physical access to the facility to be monitored so that physical security incidents are detected and responded to, physical access logs to be reviewed at a defined frequency and on defined events, and review and
4
artefacts
1
held by a system
3
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring arrangements such as alarms, surveillance or guard patrols · Physical access / facilities
periodic reviewEvidence produced at each review
- Physical access log review records at the defined frequency · Physical access / facilities
- Records of event driven reviews following an incident or alarm · Physical access / facilities
- Evidence of handover of physical findings into the incident response process · Physical access / facilities
governing documentDocuments that govern the control
none for this control
First move
Start with the 1 of 4 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Surveillance recorded but never reviewed unless something is already known to be wrong
- Physical incidents handled by facilities and never reach the security incident process
- Review frequency undefined, so reviews happen only on request
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-5 Access control for output devices · PE-8 Visitor access records