9.3.1 Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including: • Identifying personnel. • Managing changes to an individual's physical access requirements. • Revoking or terminating personnel identification. •
Procedures are implemented for authorizing and managing physical access of personnel to the CDE, including: • Identifying personnel. • Managing changes to an individual's physical access requirements. • Revoking or termi.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the identification mechanism in use, such as badges, and observation of it being applied · Physical access / facilities
- Records of changes to individual physical access requirements, and of revocation or termination of identification · Physical access / facilities
- Evidence access to the identification process itself, such as badge issuance, is limited to authorised personnel · Physical access / facilities
governing documentDocuments that govern the control
- Documented procedures for authorising and managing physical access of personnel to the cardholder data environment · Policy repository / GRC workspace
- A sample reconciliation of badge holders with current authorised personnel · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Badge deactivation on termination handled by facilities on a separate timetable from logical access revocation
- Badge issuance available to reception staff with no authorisation check on who may request one
- Changes to a person's access on role change add new areas without removing the old
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.2.4 Consoles in sensitive areas locked when not in use · 9.3.1.1 Personnel access readily revoked