PE-6 MONITORING PHYSICAL ACCESS Applicability: All Information Systems Control: The organization: Monitors physical access to the information system to detect and respond to physical security incidents; Reviews physical access logs at least semi-annually; and Coordinates results of reviews and investigations with the organization’s incident response capability. Supplemental Guidance: Investigation of and response to detected physical security incidents, including apparent security violations or suspicious physical access activities, are part of the organization’s incident response capability. Control Enhancements: The organization monitors real-time physical intrusion alarms and surveillance equipment. The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. References: None. Priority and Baseline Allocation: P1 LOW PE-6 MOD PE-6 (1) HIGH PE-6 (1) (2) PE-7 VISITOR CONTROL Applicability: All Information Systems Control: The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible. Supplemental Guidance: Individuals (to include organizational employees, contract personnel, and others) with permanent authorization credentials for the facility are not considered visitors. Control Enhancements: The organization escorts visitors and monitors visitor activity, when required. References: None. Priority and Baseline Allocation:
PE-6 MONITORING PHYSICAL ACCESS Applicability: All Information Systems Control: The organization: Monitors physical access to the information system to detect and respond to physical security incidents; Reviews physical access logs at least semi-annually; and Coordinates results of reviews and investigations with the organization’s incident response capability. Supplemental Guidance: Investigation of and response to detected physical security incidents, including apparent security violations or suspicious physical access activities, are part of the organization’s incident response capability. Control Enhancements: The organization monitors real-time physical intrusion alarms and surveillance equipment. The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. References: None. Priority and Baseline Allocation: P1 LOW PE-6 MOD PE-6 (1) HIGH PE-6 (1) (2) PE-7 VISITOR CONTROL Applicability: All Information Systems Control: The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible. Supplemental Guidance: Individuals (to include organizational employees, contract personnel, and others) with permanent authorization credentials for the facility are not considered visitors. Control Enhancements: The organization escorts visitors and monitors visitor activity, when required. References: None. Priority and Baseline Allocation:
attachment_1_-_physical_and_environmental_protection_v1.1.docx