PE-3 (3) - Physical Access Control The organization guards, alarms, and monitors every physical access point to the facility where the information system resides 24 hours per day, 7 days per week. PE-3 (3) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> PE-3 (3) What is the solution and how is it implemented? Physical and Environmental Protection (PE) changed – controls PE-2c Physical Access Authorizations – The organization: … c. Reviews and approves the access list and authorization credentials [Assignment: removing from the access list, personnel no longer requiring access. frequency], DoD parameter: [monthly] FedRAMP baseline parameter: [at least annually] PE-2c Control Enhancement Summary Information
PE-3 (3) - Physical Access Control The organization guards, alarms, and monitors every physical access point to the facility where the information system resides 24 hours per day, 7 days per week. PE-3 (3) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> PE-3 (3) What is the solution and how is it implemented? Physical and Environmental Protection (PE) – changed controls PE-2c – Physical Access Authorizations The organization: … c. Reviews and approves the access list and authorization credentials [Assignment: frequency], removing from the access list, personnel no longer requiring access. DoD parameter: [monthly] FedRAMP baseline parameter: [at least annually] PE-2c Control Enhancement Summary Information
U_CSM_level_4_saas_template.docx