The Responsible Entity assess, or correct the access through a physical deficiencies but did not has a process to log deficiencies. (1.7) access point into a assess or correct the authorized physical OR Physical security deficiencies. (1.1) entry into any Physical The Responsible Entity has a Perimeter but did not OR Security Perimeter with process communicate alerts identify, assess, or correct The Responsible Entity sufficient information within 15 minutes to identified deficiencies. (1.5) documented and to identify the personnel and identified OR implemented individual and date and deficiencies but did not assess The Responsible Entity operational or time of entry but did not or correct the deficiencies. (1.7) has a process to procedural controls to identify, assess, or OR communicate alerts within restrict physical access correct the deficiencies. The Responsible Entity has a 15 minutes to identified but did not identify, (1.8) process communicate alerts personnel and identified assess, or correct the OR within 15 minutes to identified deficiencies but did not deficiencies. (1.1) The Responsible Entity personnel but did not identify, assess or correct the OR has a process to retain assess, or correct the deficiencies. (1.5) The Responsible Entity physical access logs for deficiencies. (1.7) OR has documented and 90 calendar days and The Responsible Entity implemented physical identified deficiencies has a process to access controls, but at but did not assess or communicate alerts within least one control does correct the deficiencies. 15 minutes to identified not exist to restrict (1.9) personnel but did not access to Applicable OR identify, assess, or correct Systems. (1.2) The Responsible Entity the deficiencies. (1.5) OR has a process to retain OR The Responsible Entity physical access logs for The Responsible Entity has documented and 90 calendar days but has a process to monitor implemented physical did not identify, assess, for unauthorized physical access controls, or correct the access to a Physical restricts access to deficiencies. (1.9) Access Control Systems Applicable Systems and identified deficiencies using at least one but did not assess or control, and identified correct the deficiencies. deficiencies, but did (1.6) not assess or correct the OR deficiencies. (1.2) The Responsible Entity OR has a process to monitor The Responsible Entity for unauthorized physical has documented and access to a Physical implemented physical Access Control Systems access controls,
The Responsible Entity has a process to log authorized physical entry into any Physical Security Perimeter with sufficient information to identify the individual and date and time of entry but did not identify, assess, or correct the deficiencies. (1.8) OR The Responsible Entity has a process to retain physical access logs for 90 calendar days and identified deficiencies but did not assess or correct the deficiencies. (1.9) OR The Responsible Entity has a process to retain physical access logs for 90 calendar days but did not identify, assess, or correct the deficiencies. (1.9) assess, or correct the deficiencies. (1.7) OR The Responsible Entity has a process communicate alerts within 15 minutes to identified personnel and identified deficiencies but did not assess or correct the deficiencies. (1.7) OR The Responsible Entity has a process communicate alerts within 15 minutes to identified personnel but did not identify, assess, or correct the deficiencies. (1.7) access through a physical access point into a Physical security Perimeter but did not identify, assess, or correct deficiencies. (1.5) OR The Responsible Entity has a process to communicate alerts within 15 minutes to identified personnel and identified deficiencies but did not assess or correct the deficiencies. (1.5) OR The Responsible Entity has a process to communicate alerts within 15 minutes to identified personnel but did not identify, assess, or correct the deficiencies. (1.5) OR The Responsible Entity has a process to monitor for unauthorized physical access to a Physical Access Control Systems and identified deficiencies but did not assess or correct the deficiencies. (1.6) OR The Responsible Entity has a process to monitor for unauthorized physical access to a Physical Access Control Systems deficiencies but did not assess or correct the deficiencies. (1.1) OR The Responsible Entity documented and implemented operational or procedural controls to restrict physical access but did not identify, assess, or correct the deficiencies. (1.1) OR The Responsible Entity has documented and implemented physical access controls, but at least one control does not exist to restrict access to Applicable Systems. (1.2) OR The Responsible Entity has documented and implemented physical access controls, restricts access to Applicable Systems using at least one control, and identified deficiencies, but did not assess or correct the deficiencies. (1.2) OR The Responsible Entity has documented and implemented physical access controls,
VSL_Matrix_Complete_2016_01_27.docx