DE.CM-02 The physical environment is monitored to find potentially adverse events
The physical environment is monitored to find potentially adverse events. Control from NIST Cybersecurity Framework 2.0 framework, domain: DE - Detect.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Physical access logs integrated with security operations · Physical access / facilities
- Environmental sensor telemetry feed (door, temperature, motion) · Physical access / facilities
periodic reviewEvidence produced at each review
- Tailgating detection review records · Document repository
governing documentDocuments that govern the control
- CCTV coverage map with retention policy · Policy repository / GRC workspace
- Visitor management system reports with anomaly flags · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Physical and logical SOCs operate in silos
- Co-location facilities outside the monitoring scope
- CCTV retention shorter than incident discovery windows
- Sensor alerts not joined to identity context
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDE.CM-01 Networks and network services are monitored to find potentially adverse events · DE.CM-03 Personnel activity and technology usage are monitored to find potentially adverse events