frequency], removing from the access list personnel no longer requiring access. PE-3 The organization: The organization enforces physical Physical Access Control Enforces physical access authorizations for all access authorizations to the information physical access points (including designated system independent of the physical entry/exit points) to the facility where the information access controls for the facility. system resides (excluding those areas within the facility officially designated publicly accessible); Verifies individual access authorizations before granting access to the facility; Controls entry to the facility containing the information system using physical access devices and/or guards; Controls access to areas officially designated publicly accessible in accordance with the organization’s assessment of risk; Secures keys, combinations, and other physical access devices; Inventories physical access devices [Assignment: organization-defined frequency]; and Changes combinations and keys [Assignment: and when keys are organization-defined frequency] lost, combinations are compromised, or individuals are transferred or terminated. PE-4 The organization controls physical access to information Access Control for system distribution and transmission lines within Transmission Medium organizational facilities. PE-5 The organization controls physical access to information Access Control for Output system output devices to prevent unauthorized individuals Devices from obtaining the output. PE-6 The organization: (1) The organization monitors real-time physical intrusion The organization employs automated Monitoring Physical Monitors physical access to the information system alarms and surveillance equipment. mechanisms to recognize potential Access to detect and respond to physical security incidents; intrusions and initiate designated Reviews physical access logs [Assignment: response actions. organization-defined frequency]; and Coordinates results of reviews and investigations with the organization’s incident response capability. PE-7 The organization controls physical access to the (1) The organization escorts visitors and monitors visitor Visitor Control information system by authenticating activity, when required. visitors before authorizing access to the facility where the information system resides other than areas designated publicly accessible. PE-8 The organization: The organization employs automated Access Records Maintains visitor access records to the facility where mechanisms to facilitate the the information system resides (except for those maintenance and review of access areas within the facility officially designated publicly records. accessible); and The organization maintains a record of Reviews visitor access records [Assignment: all physical access, both visitor and organization-defined frequency]. authorized individuals.
frequency], removing from the access list personnel no longer requiring access. PE-3 Physical Access Control The organization: Enforces physical access authorizations for all physical access points (including designated entry/exit points) to the facility where the information system resides (excluding those areas within the facility officially designated publicly accessible); Verifies individual access authorizations before granting access to the facility; Controls entry to the facility containing the information system using physical access devices and/or guards; Controls access to areas officially designated publicly accessible in accordance with the organization’s assessment of risk; Secures keys, combinations, and other physical access devices; Inventories physical access devices [Assignment: organization-defined frequency]; and Changes combinations and keys [Assignment: organization-defined frequency] and when keys are lost, combinations are compromised, or individuals are transferred or terminated. The organization enforces physical access authorizations to the information system independent of the physical access controls for the facility. PE-4 Access Control for Transmission Medium The organization controls physical access to information system distribution and transmission lines within organizational facilities. PE-5 Access Control for Output Devices The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output. PE-6 Monitoring Physical Access The organization: Monitors physical access to the information system to detect and respond to physical security incidents; Reviews physical access logs [Assignment: organization-defined frequency]; and Coordinates results of reviews and investigations with the organization’s incident response capability. (1) The organization monitors real-time physical intrusion alarms and surveillance equipment. The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. PE-7 Visitor Control The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated publicly accessible. (1) The organization escorts visitors and monitors visitor activity, when required. PE-8 Access Records The organization: Maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated publicly accessible); and Reviews visitor access records [Assignment: organization-defined frequency]. The organization employs automated mechanisms to facilitate the maintenance and review of access records. The organization maintains a record of all physical access, both visitor and authorized individuals.