identified The Responsible Entity has a process correct the deficiencies but did not deficiencies but communicate alerts within 15 deficiencies. (1.5) assess or correct the did not assess or minutes to identified personnel and OR deficiencies. (1.1) correct the identified deficiencies but did not The Responsible OR deficiencies. assess or correct the deficiencies. Entity has a The Responsible Entity (1.8) (1.7) process to alert for documented and OR OR detected implemented The Responsible The Responsible Entity has a process unauthorized operational or Entity has a communicate alerts within 15 access through a procedural controls to process to log minutes to identified personnel but physical access restrict physical access authorized did not identify, assess, or correct the point into a but did not identify, physical entry deficiencies. (1.7) Physical security assess, or correct the into any Physical Perimeter but did deficiencies. (1.1) Security not identify, OR Perimeter with assess, or correct The Responsible Entity sufficient deficiencies. (1.5) has documented and information to OR implemented physical identify the The Responsible access controls, but at individual and Entity has a least one control does date and time of process to not exist to restrict entry but did not communicate access to Applicable identify, assess, alerts within 15 Systems. (1.2) or correct the minutes to OR deficiencies. identified The Responsible Entity (1.8) personnel and has documented and OR identified implemented physical The Responsible deficiencies but access controls, Entity has a did not assess or restricts access to process to retain correct the Applicable Systems physical access deficiencies. (1.5) using at least one logs for 90 OR control, and identified calendar days The Responsible deficiencies, but did and identified Entity has a not assess or correct the deficiencies but process to deficiencies. (1.2) did not assess or communicate OR correct the alerts within 15 The Responsible Entity deficiencies. minutes to has documented and (1.9) identified implemented physical OR personnel but did access controls,
identified deficiencies but did not assess or correct the deficiencies. (1.8) OR The Responsible Entity has a process to log authorized physical entry into any Physical Security Perimeter with sufficient information to identify the individual and date and time of entry but did not identify, assess, or correct the deficiencies. (1.8) OR The Responsible Entity has a process to retain physical access logs for 90 calendar days and identified deficiencies but did not assess or correct the deficiencies. (1.9) OR The Responsible Entity has a process communicate alerts within 15 minutes to identified personnel and identified deficiencies but did not assess or correct the deficiencies. (1.7) OR The Responsible Entity has a process communicate alerts within 15 minutes to identified personnel but did not identify, assess, or correct the deficiencies. (1.7) correct the deficiencies. (1.5) OR The Responsible Entity has a process to alert for detected unauthorized access through a physical access point into a Physical security Perimeter but did not identify, assess, or correct deficiencies. (1.5) OR The Responsible Entity has a process to communicate alerts within 15 minutes to identified personnel and identified deficiencies but did not assess or correct the deficiencies. (1.5) OR The Responsible Entity has a process to communicate alerts within 15 minutes to identified personnel but did deficiencies but did not assess or correct the deficiencies. (1.1) OR The Responsible Entity documented and implemented operational or procedural controls to restrict physical access but did not identify, assess, or correct the deficiencies. (1.1) OR The Responsible Entity has documented and implemented physical access controls, but at least one control does not exist to restrict access to Applicable Systems. (1.2) OR The Responsible Entity has documented and implemented physical access controls, restricts access to Applicable Systems using at least one control, and identified deficiencies, but did not assess or correct the deficiencies. (1.2) OR The Responsible Entity has documented and implemented physical access controls,