PE-2 Control Summary Information Responsible Role: Parameter PE-2(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PE-2 What is the solution and how is it implemented? Part a Part b Part c Part d PE-3 Physical Access Control The organization: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress/egress to the facility using [FedRAMP Assignment: CSP physical access control systems/devices AND guards]; Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; Escorts visitors and monitors visitor activity [FedRAMP Assignment: in all circumstances within restricted access area where the information system resides]; Secures keys, combinations, and other physical access devices; Inventories [Assignment: organization-defined physical access devices] every
PE-2 Control Summary Information Responsible Role: Parameter PE-2(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PE-2 What is the solution and how is it implemented? Part a Part b Part c Part d PE-3 Physical Access Control The organization: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress/egress to the facility using [FedRAMP Assignment: CSP physical access control systems/devices AND guards]; Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; Escorts visitors and monitors visitor activity [FedRAMP Assignment: in all circumstances within restricted access area where the information system resides]; Secures keys, combinations, and other physical access devices; Inventories [Assignment: organization-defined physical access devices] every
FedRAMP_System_Security_Plan_(Low_and_Moderate).docx